diff --git a/.dev.vars.example b/.dev.vars.example
deleted file mode 100644
index 802b941..0000000
--- a/.dev.vars.example
+++ /dev/null
@@ -1,8 +0,0 @@
-ADMIN_USERNAME=change-this-local-username
-ADMIN_PASSWORD=change-this-local-password
-# Optional: configure Turnstile through Worker variables instead of the admin panel.
-# TURNSTILE_SITE_KEY=your-site-key
-# TURNSTILE_SECRET_KEY=your-secret-key
-# Optional: enable Cloudflare usage statistics in the admin data workspace.
-# CF_USAGE_ACCOUNT_ID=your-account-id
-# CF_USAGE_API_TOKEN=token-with-account-analytics-read
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b8d5a95..074def6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -49,9 +49,23 @@ jobs:
     name: Quality checks
     needs: metadata
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 40
     env:
       NODEFLARE_VERSION: ${{ needs.metadata.outputs.version }}
+    services:
+      postgres:
+        image: postgres:18-alpine
+        env:
+          POSTGRES_DB: nodeflare_smoke
+          POSTGRES_USER: nodeflare
+          POSTGRES_PASSWORD: SmokePostgresPassword123
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U nodeflare -d nodeflare_smoke"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -59,7 +73,6 @@ jobs:
       - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           components: clippy, rustfmt
-          targets: wasm32-unknown-unknown
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version: 1.4.0
@@ -71,56 +84,165 @@ jobs:
         run: bun test --cwd frontend
       - name: Build frontend
         run: bun run build:frontend
-      - name: Check Rust formatting
-        run: cargo fmt --all -- --check
+      - name: Check backend formatting
+        run: cargo fmt --manifest-path backend/Cargo.toml -- --check
       - name: Check Agent formatting
         run: cargo fmt --manifest-path agent/Cargo.toml -- --check
-      - name: Lint Worker
-        run: cargo clippy --locked --all-targets -- -D warnings
+      - name: Lint backend
+        run: CARGO_TARGET_DIR=target/backend cargo clippy --locked --manifest-path backend/Cargo.toml --all-targets -- -D warnings
       - name: Lint Agent
-        run: cargo clippy --locked --manifest-path agent/Cargo.toml --all-targets -- -D warnings
-      - name: Test Worker
-        run: cargo test --locked --lib
+        run: CARGO_TARGET_DIR=target/agent cargo clippy --locked --manifest-path agent/Cargo.toml --all-targets -- -D warnings
+      - name: Test backend
+        run: CARGO_TARGET_DIR=target/backend cargo test --locked --manifest-path backend/Cargo.toml
       - name: Test Agent
-        run: cargo test --locked --manifest-path agent/Cargo.toml
-      - name: Build Worker
-        run: NODEFLARE_ADMIN_READY=1 sh scripts/build-worker.sh
-      - name: Smoke test Worker and D1
+        run: CARGO_TARGET_DIR=target/agent cargo test --locked --manifest-path agent/Cargo.toml
+      - name: Build backend
+        run: CARGO_TARGET_DIR=target/backend cargo build --locked --manifest-path backend/Cargo.toml
+      - name: Smoke test SQLite and PostgreSQL
         shell: bash
+        env:
+          POSTGRES_URL: postgres://nodeflare:SmokePostgresPassword123@127.0.0.1:5432/nodeflare_smoke
         run: |
           set -euo pipefail
-          state_dir="$RUNNER_TEMP/nodeflare-state"
-          log_file="$RUNNER_TEMP/nodeflare-dev.log"
-          export XDG_CONFIG_HOME="$RUNNER_TEMP/wrangler-config"
-          mkdir -p "$XDG_CONFIG_HOME"
+          sqlite_pid=""
+          postgres_pid=""
+          cleanup() {
+            if [ -n "$sqlite_pid" ]; then kill "$sqlite_pid" 2>/dev/null || true; fi
+            if [ -n "$postgres_pid" ]; then kill "$postgres_pid" 2>/dev/null || true; fi
+          }
+          trap cleanup EXIT
 
-          bunx wrangler d1 migrations apply DB --local --persist-to "$state_dir"
-          NODEFLARE_ADMIN_READY=1 NODEFLARE_WORKER_READY=1 \
-            bunx wrangler dev --local --persist-to "$state_dir" --port 8787 \
-              --var ADMIN_USERNAME:smoke --var ADMIN_PASSWORD:SmokePassword123 \
-              >"$log_file" 2>&1 &
-          dev_pid=$!
-          trap 'kill "$dev_pid" 2>/dev/null || true' EXIT
-
-          ready=0
-          for _ in $(seq 1 30); do
-            if curl --fail --silent http://127.0.0.1:8787/api/bootstrap >/dev/null; then
-              ready=1
-              break
-            fi
-            sleep 1
-          done
-          if [ "$ready" != 1 ]; then
+          wait_ready() {
+            local url=$1
+            local log_file=$2
+            local process_id=$3
+            for _ in $(seq 1 60); do
+              if curl --fail --silent "$url/api/bootstrap" >/dev/null; then return 0; fi
+              if ! kill -0 "$process_id" 2>/dev/null; then break; fi
+              sleep 1
+            done
             cat "$log_file"
+            return 1
+          }
+
+          sqlite_dir="$RUNNER_TEMP/nodeflare-sqlite"
+          mkdir -p "$sqlite_dir"
+          sqlite_config="$sqlite_dir/config.toml"
+          printf '%s\n' \
+            "database_url = \"sqlite://$sqlite_dir/nodeflare.db\"" \
+            'bind_addr = "127.0.0.1:18080"' \
+            'admin_username = "sqlite-smoke"' \
+            'admin_password = "SmokePassword123"' \
+            'turnstile_site_key = ""' \
+            'turnstile_secret_key = ""' \
+            "frontend_dir = \"$GITHUB_WORKSPACE/frontend/dist\"" \
+            "admin_frontend_dir = \"$GITHUB_WORKSPACE/frontend/admin-dist\"" \
+            "agent_dir = \"$GITHUB_WORKSPACE/agent\"" > "$sqlite_config"
+          target/backend/debug/nodeflare-backend --config "$sqlite_config" > "$sqlite_dir/server.log" 2>&1 &
+          sqlite_pid=$!
+          wait_ready http://127.0.0.1:18080 "$sqlite_dir/server.log" "$sqlite_pid"
+          MONITOR_BASE_URL=http://127.0.0.1:18080 \
+            MONITOR_ADMIN_USERNAME=sqlite-smoke \
+            MONITOR_ADMIN_PASSWORD=SmokePassword123 \
+            sh scripts/smoke-test.sh
+          kill "$sqlite_pid"
+          wait "$sqlite_pid" || true
+          sqlite_pid=""
+
+          postgres_dir="$RUNNER_TEMP/nodeflare-postgres"
+          mkdir -p "$postgres_dir"
+          postgres_config="$postgres_dir/config.toml"
+          printf '%s\n' \
+            "database_url = \"$POSTGRES_URL\"" \
+            'bind_addr = "127.0.0.1:18081"' \
+            'admin_username = "postgres-smoke"' \
+            'admin_password = "SmokePassword123"' \
+            'turnstile_site_key = ""' \
+            'turnstile_secret_key = ""' \
+            "frontend_dir = \"$GITHUB_WORKSPACE/frontend/dist\"" \
+            "admin_frontend_dir = \"$GITHUB_WORKSPACE/frontend/admin-dist\"" \
+            "agent_dir = \"$GITHUB_WORKSPACE/agent\"" > "$postgres_config"
+          target/backend/debug/nodeflare-backend --config "$postgres_config" > "$postgres_dir/server.log" 2>&1 &
+          postgres_pid=$!
+          wait_ready http://127.0.0.1:18081 "$postgres_dir/server.log" "$postgres_pid"
+          MONITOR_BASE_URL=http://127.0.0.1:18081 \
+            MONITOR_ADMIN_USERNAME=postgres-smoke \
+            MONITOR_ADMIN_PASSWORD=SmokePassword123 \
+            sh scripts/smoke-test.sh
+
+  server:
+    name: Server (${{ matrix.platform }})
+    needs: metadata
+    if: needs.metadata.outputs.release == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    permissions:
+      attestations: write
+      contents: read
+      id-token: write
+    env:
+      CARGO_TARGET_DIR: target/server
+      NODEFLARE_VERSION: ${{ needs.metadata.outputs.version }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: Linux x64
+            target: x86_64-unknown-linux-musl
+            asset: nodeflare-server-linux-x64
+            emulate: false
+          - platform: Linux ARM64
+            target: aarch64-unknown-linux-musl
+            asset: nodeflare-server-linux-aarch64
+            emulate: true
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        with:
+          targets: ${{ matrix.target }}
+      - name: Install cross compiler
+        run: cargo install cross --version 0.2.5 --locked
+      - name: Build server
+        run: CROSS_CONFIG=agent/Cross.toml cross build --manifest-path backend/Cargo.toml --release --locked --target ${{ matrix.target }}
+      - name: Stage server binary
+        run: |
+          mkdir -p release
+          cp "target/server/${{ matrix.target }}/release/nodeflare-backend" "release/${{ matrix.asset }}"
+          chmod +x "release/${{ matrix.asset }}"
+      - name: Install ARM64 emulator
+        if: matrix.emulate
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes --no-install-recommends qemu-user-static
+      - name: Verify server version
+        shell: bash
+        run: |
+          if [ "${{ matrix.emulate }}" = "true" ]; then
+            version_output=$(qemu-aarch64-static "release/${{ matrix.asset }}" --version)
+          else
+            version_output=$("release/${{ matrix.asset }}" --version)
+          fi
+          actual_version="${version_output##* }"
+          if [ "$actual_version" != "${{ needs.metadata.outputs.version }}" ]; then
+            echo "Server version $actual_version does not match tag ${{ needs.metadata.outputs.version }}" >&2
             exit 1
           fi
-
-          if ! MONITOR_BASE_URL=http://127.0.0.1:8787 \
-            MONITOR_ADMIN_USERNAME=smoke MONITOR_ADMIN_PASSWORD=SmokePassword123 \
-            sh scripts/smoke-test.sh; then
-            cat "$log_file"
+      - name: Verify static server binary
+        run: |
+          if readelf -l "release/${{ matrix.asset }}" | grep -q 'Requesting program interpreter'; then
+            echo "Linux server must be statically linked" >&2
             exit 1
           fi
+      - uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4
+        with:
+          subject-path: release/${{ matrix.asset }}
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: ${{ matrix.asset }}
+          path: release/${{ matrix.asset }}
+          if-no-files-found: error
 
   agent:
     name: Agent (${{ matrix.platform }})
@@ -183,7 +305,7 @@ jobs:
         run: cargo install cross --version 0.2.5 --locked
       - name: Build Rust Agent with cross
         if: matrix.cross
-        run: CROSS_CONFIG=Cross.toml cross build --manifest-path agent/Cargo.toml --release --locked --target ${{ matrix.target }}
+        run: CROSS_CONFIG=agent/Cross.toml cross build --manifest-path agent/Cargo.toml --release --locked --target ${{ matrix.target }}
       - name: Build Rust Agent with Cargo
         if: matrix.cross == false
         run: cargo build --manifest-path agent/Cargo.toml --release --locked --target ${{ matrix.target }}
@@ -282,10 +404,10 @@ jobs:
           bun-version: 1.4.0
       - name: Install dependencies
         run: bun install --frozen-lockfile
-      - name: Build public frontend
-        run: bun run --cwd frontend build:public
+      - name: Build public and admin frontends
+        run: bun run build:frontend
       - name: Package frontend
-        run: tar -czf "nodeflare-frontend-${{ needs.metadata.outputs.version }}.tar.gz" -C frontend/dist .
+        run: tar -czf "nodeflare-frontend-${{ needs.metadata.outputs.version }}.tar.gz" -C frontend dist admin-dist
       - uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4
         with:
           subject-path: nodeflare-frontend-${{ needs.metadata.outputs.version }}.tar.gz
@@ -298,7 +420,7 @@ jobs:
   release:
     name: Publish GitHub Release
     if: startsWith(github.ref, 'refs/tags/v')
-    needs: [metadata, quality, agent, frontend]
+    needs: [metadata, quality, server, agent, frontend]
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..767e9fd
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,51 @@
+# 构建产物
+/build/
+/target/
+/backend/target/
+/backend/build/
+/agent/target/
+/frontend/dist/
+/frontend/admin-dist/
+/release/
+
+# 依赖
+/node_modules/
+/frontend/node_modules/
+
+# 数据库文件
+/backend/*.db
+/backend/*.db-shm
+/backend/*.db-wal
+*.db
+*.db-shm
+*.db-wal
+
+# 配置文件（包含密钥）
+/backend/config.toml
+config.toml
+
+# SQLx 编译时缓存
+/backend/.sqlx/
+.sqlx/
+
+# 本地运行状态
+*.log
+
+# 旧版部署遗留的本地密钥，避免迁移时误提交
+.dev.vars
+.dev.vars.*
+
+# 增量编译缓存。tsconfig 把它们指向 node_modules/.cache，
+# 这条只是兜住散落在别处的。
+*.tsbuildinfo
+
+# 编辑器与操作系统
+/.idea/
+/.vscode/
+.DS_Store
+Thumbs.db
+
+# 本机 agent 工具目录，不属于项目
+/.agents/
+/.claude/
+/.codex/
diff --git a/Cargo.lock b/Cargo.lock
deleted file mode 100644
index 2f5cd1b..0000000
--- a/Cargo.lock
+++ /dev/null
@@ -1,918 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 4
-
-[[package]]
-name = "async-trait"
-version = "0.1.92"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.4",
-]
-
-[[package]]
-name = "autocfg"
-version = "1.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
-
-[[package]]
-name = "base64"
-version = "0.23.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
-
-[[package]]
-name = "block-buffer"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
-dependencies = [
- "hybrid-array",
-]
-
-[[package]]
-name = "bumpalo"
-version = "3.20.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
-
-[[package]]
-name = "bytes"
-version = "1.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
-
-[[package]]
-name = "cfg-if"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
-
-[[package]]
-name = "chrono"
-version = "0.4.45"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
-dependencies = [
- "js-sys",
- "num-traits",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "cmov"
-version = "0.5.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
-
-[[package]]
-name = "const-oid"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
-
-[[package]]
-name = "cpufeatures"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "crypto-common"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
-dependencies = [
- "hybrid-array",
-]
-
-[[package]]
-name = "ctutils"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
-dependencies = [
- "cmov",
-]
-
-[[package]]
-name = "digest"
-version = "0.11.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
-dependencies = [
- "block-buffer",
- "const-oid",
- "crypto-common",
- "ctutils",
-]
-
-[[package]]
-name = "displaydoc"
-version = "0.2.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.4",
-]
-
-[[package]]
-name = "form_urlencoded"
-version = "1.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
-dependencies = [
- "percent-encoding",
-]
-
-[[package]]
-name = "futures-channel"
-version = "0.3.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4"
-dependencies = [
- "futures-core",
-]
-
-[[package]]
-name = "futures-core"
-version = "0.3.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
-
-[[package]]
-name = "futures-io"
-version = "0.3.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53c0fa8157de1303bfffdaa1cc2a673bfffb60102f76b0ef4441659124373fed"
-
-[[package]]
-name = "futures-macro"
-version = "0.3.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.4",
-]
-
-[[package]]
-name = "futures-sink"
-version = "0.3.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1944426bf7d03f1d14f708785e4b33efd750b36d48a157b836b3efc15ede8e1d"
-
-[[package]]
-name = "futures-task"
-version = "0.3.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
-
-[[package]]
-name = "futures-util"
-version = "0.3.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
-dependencies = [
- "futures-core",
- "futures-io",
- "futures-macro",
- "futures-sink",
- "futures-task",
- "memchr",
- "pin-project-lite",
- "slab",
-]
-
-[[package]]
-name = "heck"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
-
-[[package]]
-name = "hmac"
-version = "0.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
-dependencies = [
- "digest",
-]
-
-[[package]]
-name = "http"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
-dependencies = [
- "bytes",
- "itoa",
-]
-
-[[package]]
-name = "http-body"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
-dependencies = [
- "bytes",
- "http",
-]
-
-[[package]]
-name = "hybrid-array"
-version = "0.4.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "707114b52a152fa7bdb290cd7cd5912d9467273b6d74e21b8d81aca1f8533f6b"
-dependencies = [
- "typenum",
-]
-
-[[package]]
-name = "icu_collections"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513"
-dependencies = [
- "displaydoc",
- "potential_utf",
- "utf8_iter",
- "yoke",
- "zerofrom",
- "zerovec",
-]
-
-[[package]]
-name = "icu_locale_core"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
-dependencies = [
- "displaydoc",
- "litemap",
- "tinystr",
- "writeable",
- "zerovec",
-]
-
-[[package]]
-name = "icu_normalizer"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12f9cf5f235641ed274641dd81c3f28d870e276763d0797aeeab72317b1c646f"
-dependencies = [
- "icu_collections",
- "icu_normalizer_data",
- "icu_properties",
- "icu_provider",
- "smallvec",
- "zerovec",
-]
-
-[[package]]
-name = "icu_normalizer_data"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
-
-[[package]]
-name = "icu_properties"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e7ca276ad3145661a65914e6daf131ca5120cd3dcee8f8f3214b8875184a148"
-dependencies = [
- "displaydoc",
- "icu_collections",
- "icu_locale_core",
- "icu_properties_data",
- "icu_provider",
- "zerotrie",
- "zerovec",
-]
-
-[[package]]
-name = "icu_properties_data"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa"
-
-[[package]]
-name = "icu_provider"
-version = "2.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
-dependencies = [
- "displaydoc",
- "icu_locale_core",
- "writeable",
- "yoke",
- "zerofrom",
- "zerotrie",
- "zerovec",
-]
-
-[[package]]
-name = "idna"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
-dependencies = [
- "idna_adapter",
- "smallvec",
- "utf8_iter",
-]
-
-[[package]]
-name = "idna_adapter"
-version = "1.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
-dependencies = [
- "icu_normalizer",
- "icu_properties",
-]
-
-[[package]]
-name = "itoa"
-version = "1.0.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
-
-[[package]]
-name = "js-sys"
-version = "0.3.104"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e0c1080212aad755ea003d18543e8768dd432c48819efd73a7bf1e39b7a5a3a"
-dependencies = [
- "cfg-if",
- "futures-util",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "libc"
-version = "0.2.189"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
-
-[[package]]
-name = "litemap"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
-
-[[package]]
-name = "matchit"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e7465ac9959cc2b1404e8e2367b43684a6d13790fe23056cc8c6c5a6b7bcb94"
-
-[[package]]
-name = "memchr"
-version = "2.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
-
-[[package]]
-name = "nodeflare-worker"
-version = "0.0.1"
-dependencies = [
- "base64",
- "futures-util",
- "hmac",
- "pbkdf2",
- "serde",
- "serde_json",
- "sha2",
- "worker",
-]
-
-[[package]]
-name = "num-traits"
-version = "0.2.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
-dependencies = [
- "autocfg",
-]
-
-[[package]]
-name = "once_cell"
-version = "1.21.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
-
-[[package]]
-name = "pbkdf2"
-version = "0.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "112d82ceb8c5bf524d9af484d4e4970c9fd5a0cc15ba14ad93dccd28873b0629"
-dependencies = [
- "digest",
- "hmac",
-]
-
-[[package]]
-name = "percent-encoding"
-version = "2.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
-
-[[package]]
-name = "pin-project"
-version = "1.1.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2466b2336ed02bcdca6b294417127b90ec92038d1d5c4fbeac971a922e0e0924"
-dependencies = [
- "pin-project-internal",
-]
-
-[[package]]
-name = "pin-project-internal"
-version = "1.1.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c96395f0a926bc13b1c17622aaddda1ecb55d49c8f1bf9777e4d877800a43f8b"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "pin-project-lite"
-version = "0.2.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
-
-[[package]]
-name = "potential_utf"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
-dependencies = [
- "zerovec",
-]
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.107"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.47"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "rustversion"
-version = "1.0.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
-
-[[package]]
-name = "ryu"
-version = "1.0.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
-
-[[package]]
-name = "serde"
-version = "1.0.229"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
-dependencies = [
- "serde_core",
- "serde_derive",
-]
-
-[[package]]
-name = "serde-wasm-bindgen"
-version = "0.6.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8302e169f0eddcc139c70f139d19d6467353af16f9fce27e8c30158036a1e16b"
-dependencies = [
- "js-sys",
- "serde",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "serde_core"
-version = "1.0.229"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
-dependencies = [
- "serde_derive",
-]
-
-[[package]]
-name = "serde_derive"
-version = "1.0.229"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.4",
-]
-
-[[package]]
-name = "serde_json"
-version = "1.0.151"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
-dependencies = [
- "itoa",
- "memchr",
- "serde",
- "serde_core",
- "zmij",
-]
-
-[[package]]
-name = "serde_urlencoded"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
-dependencies = [
- "form_urlencoded",
- "itoa",
- "ryu",
- "serde",
-]
-
-[[package]]
-name = "sha2"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
-dependencies = [
- "cfg-if",
- "cpufeatures",
- "digest",
-]
-
-[[package]]
-name = "slab"
-version = "0.4.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
-
-[[package]]
-name = "smallvec"
-version = "1.15.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
-
-[[package]]
-name = "stable_deref_trait"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
-
-[[package]]
-name = "strum"
-version = "0.27.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af23d6f6c1a224baef9d3f61e287d2761385a5b88fdab4eb4c6f11aeb54c4bcf"
-dependencies = [
- "strum_macros",
-]
-
-[[package]]
-name = "strum_macros"
-version = "0.27.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7695ce3845ea4b33927c055a39dc438a45b059f7c1b3d91d38d10355fb8cbca7"
-dependencies = [
- "heck",
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "syn"
-version = "2.0.119"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "syn"
-version = "3.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6275cddf4610d1775e6d1fe9469b2e77d0f39fd98fb7450901b821e0c53649f"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "synstructure"
-version = "0.13.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "tinystr"
-version = "0.8.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
-dependencies = [
- "displaydoc",
- "zerovec",
-]
-
-[[package]]
-name = "tokio"
-version = "1.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
-dependencies = [
- "pin-project-lite",
-]
-
-[[package]]
-name = "typenum"
-version = "1.20.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
-
-[[package]]
-name = "url"
-version = "2.5.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
-dependencies = [
- "form_urlencoded",
- "idna",
- "percent-encoding",
- "serde",
-]
-
-[[package]]
-name = "utf8_iter"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
-
-[[package]]
-name = "wasm-bindgen"
-version = "0.2.127"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b70935747edd64d89de3efa29d73789b806c15798f8e7dca4d8ac356b50ce70"
-dependencies = [
- "cfg-if",
- "once_cell",
- "rustversion",
- "wasm-bindgen-macro",
- "wasm-bindgen-shared",
-]
-
-[[package]]
-name = "wasm-bindgen-futures"
-version = "0.4.77"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b7777d5cc23d0e91404e53ce2d5e8ec7acae3026b16233dba62cd3246457950"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "wasm-bindgen-macro"
-version = "0.2.127"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77775f8f3f7217702089053b94958f8f54061a3f663417df76e19cbdcca29bc1"
-dependencies = [
- "quote",
- "wasm-bindgen-macro-support",
-]
-
-[[package]]
-name = "wasm-bindgen-macro-support"
-version = "0.2.127"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e11d33f857dc2fb11b8bc75aee111aa9cbeb12cd9f25efd3d4c2a3dd4e235284"
-dependencies = [
- "bumpalo",
- "proc-macro2",
- "quote",
- "syn 2.0.119",
- "wasm-bindgen-shared",
-]
-
-[[package]]
-name = "wasm-bindgen-shared"
-version = "0.2.127"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ef64dbcc55df09c7e5a46182d181c2cfa3e925f3da937ea764728b4bbb9dcbf"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "wasm-streams"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7d3be8814f5ba5f074491a469eed3d73c273ffad955f25ed1635efac4b0d269"
-dependencies = [
- "futures-util",
- "js-sys",
- "wasm-bindgen",
- "wasm-bindgen-futures",
- "web-sys",
-]
-
-[[package]]
-name = "web-sys"
-version = "0.3.104"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c435338968042f4f59a557f690a253676d47ce13ceb55d70100e7facf6620a30"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "worker"
-version = "0.8.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f8adbf6c9ae45b665dee995c5e3a342c2bd7d58a2e8ca5c75b50ce8b1b8bfd9"
-dependencies = [
- "async-trait",
- "bytes",
- "chrono",
- "futures-channel",
- "futures-util",
- "http",
- "http-body",
- "js-sys",
- "matchit",
- "pin-project",
- "serde",
- "serde-wasm-bindgen",
- "serde_json",
- "serde_urlencoded",
- "strum",
- "tokio",
- "url",
- "wasm-bindgen",
- "wasm-bindgen-futures",
- "wasm-streams",
- "web-sys",
- "worker-macros",
- "worker-sys",
-]
-
-[[package]]
-name = "worker-macros"
-version = "0.8.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d908735d273dd7f9c325a842623f4e5a745e0686187ce465b34dc162ad348df"
-dependencies = [
- "async-trait",
- "proc-macro2",
- "quote",
- "strum",
- "syn 2.0.119",
- "wasm-bindgen",
- "wasm-bindgen-macro-support",
- "worker-sys",
-]
-
-[[package]]
-name = "worker-sys"
-version = "0.8.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33faa1a8fa6c7eec67b196e008859c44d468a5ad4f991855cdc856f119e0e98f"
-dependencies = [
- "cfg-if",
- "js-sys",
- "wasm-bindgen",
- "web-sys",
-]
-
-[[package]]
-name = "writeable"
-version = "0.6.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
-
-[[package]]
-name = "yoke"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
-dependencies = [
- "stable_deref_trait",
- "yoke-derive",
- "zerofrom",
-]
-
-[[package]]
-name = "yoke-derive"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
- "synstructure",
-]
-
-[[package]]
-name = "zerofrom"
-version = "0.1.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
-dependencies = [
- "zerofrom-derive",
-]
-
-[[package]]
-name = "zerofrom-derive"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
- "synstructure",
-]
-
-[[package]]
-name = "zerotrie"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
-dependencies = [
- "displaydoc",
- "yoke",
- "zerofrom",
-]
-
-[[package]]
-name = "zerovec"
-version = "0.11.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
-dependencies = [
- "yoke",
- "zerofrom",
- "zerovec-derive",
-]
-
-[[package]]
-name = "zerovec-derive"
-version = "0.11.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.4",
-]
-
-[[package]]
-name = "zmij"
-version = "1.0.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
diff --git a/Cargo.toml b/Cargo.toml
deleted file mode 100644
index 96f4441..0000000
--- a/Cargo.toml
+++ /dev/null
@@ -1,26 +0,0 @@
-[package]
-name = "nodeflare-worker"
-version = "0.0.1"
-edition = "2021"
-license = "MIT"
-description = "Rust/WASM server monitor for Cloudflare Workers"
-repository = "https://github.com/imengying/NodeFlare"
-
-[lib]
-crate-type = ["cdylib"]
-
-[dependencies]
-base64 = "0.23"
-futures-util = { version = "0.3", default-features = false }
-hmac = "0.13"
-pbkdf2 = { version = "0.13", default-features = false, features = ["hmac"] }
-serde = { version = "1", features = ["derive"] }
-serde_json = "1"
-sha2 = "0.11"
-worker = { version = "0.8", features = ["d1"] }
-
-[profile.release]
-codegen-units = 1
-lto = true
-opt-level = "s"
-strip = true
diff --git a/Cross.toml b/Cross.toml
deleted file mode 100644
index 65dca65..0000000
--- a/Cross.toml
+++ /dev/null
@@ -1,19 +0,0 @@
-[build.env]
-passthrough = ["NODEFLARE_VERSION"]
-
-[target.aarch64-unknown-linux-musl]
-runner = "qemu-user"
-
-# cross 0.2.5 自带的 FreeBSD 镜像 sysroot 是白名单拷贝的（docker/freebsd.sh 里逐个
-# `cp` 出来），漏了 libgeom，而 sysinfo 的 FreeBSD FFI 无条件 `#[link(name = "geom")]`
-# 且只受 disk/system feature 控制 —— 这两个 feature agent 都要，绕不开，链接期就
-# `cannot find -lgeom`。上游 main 分支已改成整个 `/lib/*` 全拷贝并自动补 `.so` 软链，
-# sysroot 里 libgeom.so / libbsdxml.so / libsbuf.so 齐全（已核对镜像层内容）。
-#
-# 只覆盖这一个 target，其余 target 仍走 CLI 自己推导的 :0.2.5 镜像。
-# Cross.toml 指定 image 会直接短路 image_name() 的版本推导，不存在 CLI 与镜像的版本校验。
-# 按 digest 钉死，和本仓库所有 action 钉 SHA 的做法一致；这份 digest 是 :main 的
-# multi-arch index，docker 会自己挑 linux/amd64。
-# 换来的副作用：sysroot 从 FreeBSD 12 变成 13，产物的最低运行版本相应提高到 13。
-[target.x86_64-unknown-freebsd]
-image = "ghcr.io/cross-rs/x86_64-unknown-freebsd@sha256:d1ecbeb055803f5316607acce26c8af2b8609a04e38a06ba7aed84f9df80042e"
diff --git a/README.md b/README.md
index 5becaca..cf587d5 100644
--- a/README.md
+++ b/README.md
@@ -1,106 +1,146 @@
 # NodeFlare
 
-基于 Rust、WebAssembly 和 Cloudflare Workers 的服务器监控，支持 Linux、Windows、macOS 和 FreeBSD Agent。
+NodeFlare 是一个自部署的服务器监控面板。服务端使用 Rust/Axum，通过 WebSocket 接收 Agent 指标并实时推送到浏览器，数据库可选 SQLite 或 PostgreSQL。
 
-## 界面预览
+当前版本不依赖 Cloudflare Workers、D1 或 Durable Objects。Cloudflare Turnstile 仅作为可选的人机验证功能。
 
-![仪表盘](docs/dashboard-light.png)
+## 快速开始
 
-![主题商店](docs/theme-store-light.png)
+需要稳定版 Rust、Bun 1.4+，以及常见的 C/C++ 构建工具。
 
-## 能力
-
-- 采集 CPU、GPU、负载、内存、磁盘、网络、连接数、进程和系统信息
-- TCP/ICMP 延迟检测，可按节点分配测试点和周期
-- NodeFlare Glass 风格总览、节点卡片、搜索/分组筛选、响应式深浅主题
-- 节点详情与历史图表，支持实时、1/4/24/168/720 小时范围
-- WebSocket 实时刷新与 Agent WSS 上报
-- 计费、到期、流量和多币种资产统计，Worker 每日更新汇率
-- 用户名密码登录、Cloudflare Turnstile 和节点隐藏
-- 节点管理、批量删除、拖拽排序和 Agent 在线配置
-- Telegram 通知、失败重试、资源/流量/离线/到期提醒和数据维护
-- 内置 NodeFlare Glass 主题，并提供远程主题商店
-- 远程主题支持 GitHub 仓库地址（默认 `main` 分支，也可用 `tree` 指定分支或子目录），Worker 代理 `index.html` 与 `assets/`
-- Rust Agent 支持 Linux x64/ARM64、Windows x64、macOS ARM64 和 FreeBSD x64（13 及以上），可按节点自动更新
-
-## 部署到 Cloudflare
-
-1. Fork 本仓库并打开 [Workers & Pages](https://dash.cloudflare.com/?to=/:account/workers-and-pages/create)，选择 **Import a repository** 后连接仓库。
-2. 在构建设置中将 **Build command（构建命令）清空**。Cloudflare 可能自动识别为 `bun run build`，需要手动删除；如果控制台不允许留空，可填写 `true`。
-3. 将 **Deploy command（部署命令）** 修改为 `bun run deploy`。该命令会按需构建前端和 Worker、应用 D1 迁移并完成部署，无需单独执行构建命令；同时配置 `bun run build` 会导致前端重复构建。
-4. 在 **高级设置** 中填写下表变量后部署。
-
-| 变量 | 必填/可选 | 说明 |
-| --- | ---: | --- |
-| `ADMIN_USERNAME` | 必填 | 管理员登录用户名 |
-| `ADMIN_PASSWORD` | 必填 | 初始管理员密码，勾选“加密”；后台保存密码哈希后可删除该变量 |
-| `SITE_NAME` | 可选 | 站点名称，未设置时使用 `NodeFlare` |
-| `TURNSTILE_SITE_KEY` | 可选 | Turnstile Site Key，无需加密；也可在后台设置 |
-| `TURNSTILE_SECRET_KEY` | 可选 | Turnstile Secret Key，勾选“加密”；也可在后台设置 |
-| `OFFLINE_THRESHOLD_SECONDS` | 可选 | 离线判定秒数，未设置时使用 180，范围 30-3600 |
-| `HISTORY_RETENTION_DAYS` | 可选 | 历史保留天数，未设置时使用 30，范围 1-30 |
-| `CF_USAGE_ACCOUNT_ID` | 可选 | Cloudflare 用量查询的账户 ID，不设置则不启用用量查询 |
-| `CF_USAGE_API_TOKEN` | 可选 | 用量查询 Token，勾选“加密”；需要 Account Analytics: Read，并授权对应账户 |
-
-## Agent 卸载
-
-Linux：
-
-```sh
-curl -fsSL https://raw.githubusercontent.com/imengying/NodeFlare/main/agent/agent.sh | sudo sh -s -- --uninstall
+```bash
+cp backend/config.example.toml backend/config.toml
+$EDITOR backend/config.toml
+./start.sh
 ```
 
-FreeBSD：
+必须先替换示例中的 `admin_password` 占位值，否则服务会拒绝启动。`start.sh` 会安装尚未安装的前端依赖、构建公开页和管理页、编译后端，然后监听配置的地址。
 
-```sh
-fetch -qo - https://raw.githubusercontent.com/imengying/NodeFlare/main/agent/install-freebsd.sh | sudo sh -s -- --uninstall
+默认可从 `http://127.0.0.1:8080` 访问公开面板，管理页位于 `/admin`。首次登录后可在“登录与安全”中启用 TOTP 两步验证。
+
+## 配置
+
+配置项是扁平 TOML 字段，路径均相对于配置文件所在目录解析。完整模板见 [`backend/config.example.toml`](backend/config.example.toml)。
+
+SQLite 示例：
+
+```toml
+database_url = "sqlite://nodeflare.db"
+bind_addr = "127.0.0.1:8080"
+admin_username = "admin"
+admin_password = "replace-with-a-long-random-password"
 ```
 
-## API
+PostgreSQL 示例：
 
-| 方法 | 路径 | 用途 |
-| --- | --- | --- |
-| `GET` | `/api/bootstrap` | 前台配置、节点、汇率和访问状态 |
-| `GET` | `/api/config` | 公开站点配置 |
-| `GET` | `/api/exchange-rates` | D1 中的 CNY 基准汇率快照 |
-| `GET` | `/api/servers` | 公开节点和最新指标 |
-| `GET` | `/api/history/:id?hours=24` | 节点历史 |
-| `GET` | `/api/latency/:id?hours=24` | 节点延迟任务历史 |
-| `GET` | `/api/ws` | 实时 WebSocket |
-| `GET` | `/api/agent/ws` | Agent 配置同步与指标上报 WebSocket，节点 Bearer Token |
-| `POST` | `/api/live/wake` | 总览页连上实时通道后批量唤醒可见节点的实时推送 |
-| `POST` | `/api/admin/login` | 管理登录 |
-| `POST` | `/api/admin/logout` | 退出登录（清除会话 Cookie） |
-| `GET/POST` | `/api/admin/servers` | 管理节点 |
-| `GET` | `/api/admin/servers/:id/token` | 读取节点 Agent Token |
-| `GET/POST` | `/api/admin/latency-tasks` | 查询或创建延迟任务 |
-| `PATCH/DELETE` | `/api/admin/latency-tasks/:id` | 编辑或删除延迟任务 |
-| `GET/POST` | `/api/admin/alert-rules` | 查询或创建资源告警规则 |
-| `PATCH/DELETE` | `/api/admin/alert-rules/:id` | 编辑或删除资源告警规则 |
-| `GET/PUT` | `/api/admin/telegram` | 读写 Telegram 通知配置 |
-| `POST` | `/api/admin/telegram/test` | 发送 Telegram 测试消息 |
-| `PATCH/DELETE` | `/api/admin/servers/:id` | 编辑或删除节点 |
-| `PATCH` | `/api/admin/servers/order` | 更新全部节点顺序 |
-| `DELETE` | `/api/admin/servers` | 批量删除节点 |
-| `GET/PATCH` | `/api/admin/settings` | 读写站点与展示设置 |
-| `GET/POST` | `/api/admin/themes` | 查询或添加主题 |
-| `POST` | `/api/admin/themes/:id/activate` | 启用主题 |
-| `POST` | `/api/admin/themes/:id/preview` | 创建短时主题预览链接 |
-| `DELETE` | `/api/admin/themes/:id` | 删除主题 |
-| `GET` | `/api/admin/theme-settings` | 读取当前前端提供的主题设置描述 |
-| `POST` | `/api/turnstile/verify` | 校验全站 Turnstile 令牌 |
-| `GET` | `/api/admin/database` | 查询 D1 节点、历史和数据库统计 |
-| `GET` | `/api/admin/cloudflare-usage` | 查询 UTC 今日/昨日的 D1、Workers 与 Durable Objects 用量 |
-| `POST` | `/api/admin/exchange-rates/refresh` | 立即拉取并更新 D1 汇率快照 |
-| `DELETE` | `/api/admin/history` | 清理历史指标 |
+```toml
+database_url = "postgres://nodeflare:password@127.0.0.1/nodeflare"
+bind_addr = "127.0.0.1:8080"
+admin_username = "admin"
+admin_password = "replace-with-a-long-random-password"
+```
 
-## 主题
+两种数据库都会在启动时自动执行对应迁移。修改 `database_url` 只会初始化新数据库，不会自动搬运另一数据库中的现有数据。
 
-GitHub 仓库地址对应的仓库需提供 `index.html` 和 `assets/`（默认 `main` 分支，可用 `tree` 地址指定分支或子目录），并使用 NodeFlare 公开 API 读取数据。可选的 `theme.json` 可声明后台显示的主题设置项。启用第三方主题前请确认来源可信。
+Turnstile 默认关闭。需要时同时填写 `turnstile_site_key` 和 `turnstile_secret_key`，再从管理页开启公开面板或管理员登录保护；两项留空即可完全禁用。
 
-## 鸣谢
+## 部署 Agent
 
-感谢 [CF-Server-Monitor](https://github.com/huilang-me/CF-Server-Monitor) 项目提供的思路。
+在管理页创建节点后，复制对应平台的安装命令。Agent 的服务地址应是浏览器能够访问的 NodeFlare HTTPS 地址，例如：
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/imengying/NodeFlare/main/agent/agent.sh \
+  | sudo sh -s -- -e 'https://monitor.example.com' -t 'your-agent-token'
+```
+
+Agent 通过 `/api/agent/ws` 建立 WebSocket 连接。除 localhost 调试外，安装脚本要求 HTTPS。
+
+## 开发与构建
+
+```bash
+# 构建静态前端并启动 debug 后端
+./dev.sh
+
+# 单独运行 Vite；API 和 WebSocket 会代理到 127.0.0.1:8080
+bun run dev:frontend
+
+# 构建公开页、管理页和 release 后端
+bun run build
+
+# 构建 Agent
+bun run build:agent
+```
+
+运行测试：
+
+```bash
+cargo test --locked --manifest-path backend/Cargo.toml
+cargo test --locked --manifest-path agent/Cargo.toml
+bun test --cwd frontend
+```
+
+烟雾测试需要一个已经运行的 NodeFlare 实例，以及 `curl`、`jq`、Bun 和 Node.js：
+
+```bash
+MONITOR_BASE_URL=http://127.0.0.1:8080 \
+MONITOR_ADMIN_USERNAME=admin \
+MONITOR_ADMIN_PASSWORD='your-password' \
+sh scripts/smoke-test.sh
+```
+
+## HTTPS 与反向代理
+
+生产环境建议让 NodeFlare 只监听回环地址，由 Nginx、Caddy 或同类反向代理终止 TLS。反向代理必须保留 Host、协议和 WebSocket Upgrade 头。Nginx 示例：
+
+```nginx
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    '' close;
+}
+
+server {
+    listen 443 ssl;
+    server_name monitor.example.com;
+
+    location / {
+        proxy_pass http://127.0.0.1:8080;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+    }
+}
+```
+
+`X-Forwarded-Proto: https` 也用于给管理员会话 Cookie 添加 `Secure`。NodeFlare 自身会为 API 和静态资源添加 CSP、禁止 iframe、MIME 嗅探限制等安全响应头。
+
+## 备份
+
+SQLite 默认文件是 `backend/nodeflare.db`。可在服务运行时使用 SQLite 的一致性备份命令：
+
+```bash
+sqlite3 backend/nodeflare.db ".backup '/var/backups/nodeflare.db'"
+```
+
+PostgreSQL 使用标准工具：
+
+```bash
+pg_dump --format=custom --file=/var/backups/nodeflare.dump \
+  'postgres://nodeflare:password@127.0.0.1/nodeflare'
+```
+
+恢复前请停止 NodeFlare，并先在独立环境验证备份。配置文件包含管理员初始凭据和可选的 Turnstile 密钥，也应通过权限受控的方式单独备份。
+
+## 架构
+
+- 后端：Rust、Axum、SQLx
+- 数据库：SQLite 或 PostgreSQL
+- 前端：React、TypeScript、Vite
+- 实时通信：浏览器 `/api/ws`，Agent `/api/agent/ws`
+- 认证：数据库中的不透明会话令牌，可选 TOTP 两步验证
 
 ## License
 
diff --git a/agent/Cross.toml b/agent/Cross.toml
new file mode 100644
index 0000000..d88f3d6
--- /dev/null
+++ b/agent/Cross.toml
@@ -0,0 +1,11 @@
+[build.env]
+passthrough = ["NODEFLARE_VERSION"]
+
+[target.aarch64-unknown-linux-musl]
+runner = "qemu-user"
+
+# cross 0.2.5 自带的 FreeBSD 镜像 sysroot 漏了 libgeom。上游 main 镜像已
+# 补齐完整 /lib 及共享库软链，因此为 FreeBSD Agent 固定使用该镜像摘要。
+# 该镜像以 FreeBSD 13 为 sysroot，所以产物最低支持 FreeBSD 13。
+[target.x86_64-unknown-freebsd]
+image = "ghcr.io/cross-rs/x86_64-unknown-freebsd@sha256:d1ecbeb055803f5316607acce26c8af2b8609a04e38a06ba7aed84f9df80042e"
diff --git a/agent/agent.sh b/agent/agent.sh
index 86444ec..6f18403 100644
--- a/agent/agent.sh
+++ b/agent/agent.sh
@@ -4,7 +4,6 @@ set -eu
 SERVICE_NAME="nodeflare"
 INSTALL_DIR="/opt/nodeflare"
 AGENT_FILE="$INSTALL_DIR/agent"
-TOKEN_FILE="$INSTALL_DIR/token"
 SERVICE_FILE="/etc/systemd/system/$SERVICE_NAME.service"
 OPENRC_FILE="/etc/init.d/$SERVICE_NAME"
 
@@ -13,12 +12,12 @@ usage() {
 NodeFlare Agent 安装脚本
 
 用法：
-  agent.sh -e <Worker URL> -t <Agent Token> [-i <上报间隔>] [-m <下载加速前缀>]
+  agent.sh -e <NodeFlare URL> -t <Agent Token> [-i <上报间隔>] [-m <下载加速前缀>]
   agent.sh --status
   agent.sh --uninstall
 
 参数：
-  -e  NodeFlare Worker 地址（必填）
+  -e  NodeFlare 服务地址（必填）
   -t  后台生成的 Agent Token（必填，请勿泄露）
   -i  初始上报间隔，15-3600 秒（默认 60）
   -m  GitHub 下载加速前缀（可选，仅作用于 Release 下载；
@@ -112,12 +111,12 @@ install_agent() {
   [ -n "$token" ] && [ -n "$endpoint" ] || { usage; exit 1; }
   endpoint=${endpoint%/}
   [ ${#token} -le 512 ] && [ ${#endpoint} -le 2048 ] || fail "安装参数长度超出限制"
-  safe_value "$token" && safe_value "$endpoint" || fail "Worker 地址或 Agent Token 格式无效"
+  safe_value "$token" && safe_value "$endpoint" || fail "服务地址或 Agent Token 格式无效"
   case "$endpoint" in
     https://?*|http://localhost|http://localhost/*|http://localhost:*|http://127.0.0.1|http://127.0.0.1/*|http://127.0.0.1:*) ;;
-    *) fail "Worker 地址必须使用 HTTPS；仅本机调试可使用 HTTP" ;;
+    *) fail "服务地址必须使用 HTTPS；仅本机调试可使用 HTTP" ;;
   esac
-  case "$endpoint" in *@*) fail "Worker 地址不能包含用户信息" ;; esac
+  case "$endpoint" in *@*) fail "服务地址不能包含用户信息" ;; esac
   case "$interval" in ''|*[!0-9]*) fail "上报间隔必须是整数" ;; esac
   [ "$interval" -ge 15 ] && [ "$interval" -le 3600 ] || fail "上报间隔必须在 15-3600 秒之间"
   mirror=${mirror%/}
@@ -200,9 +199,6 @@ install_agent() {
   esac
   mv "$temporary" "$AGENT_FILE"
   trap - EXIT HUP INT TERM
-  (umask 077; printf '%s\n' "$token" > "$TOKEN_FILE")
-  chmod 600 "$TOKEN_FILE"
-  token=""
   log "正在配置并启动 $init_system 服务"
   if [ "$init_system" = "systemd" ]; then
     printf '%s\n' \
@@ -213,7 +209,7 @@ install_agent() {
     '' \
     '[Service]' \
     'Type=simple' \
-    "ExecStart=$AGENT_FILE -e $endpoint --token-file $TOKEN_FILE -i $interval" \
+    "ExecStart=$AGENT_FILE -e $endpoint -t $token -i $interval" \
     'Restart=always' \
     'RestartSec=10' \
     'NoNewPrivileges=true' \
@@ -236,7 +232,7 @@ install_agent() {
       '#!/sbin/openrc-run' \
       "name=\"$SERVICE_NAME\"" \
       "command=\"$AGENT_FILE\"" \
-      "command_args=\"-e $endpoint --token-file $TOKEN_FILE -i $interval\"" \
+      "command_args=\"-e $endpoint -t $token -i $interval\"" \
       "command_user=\"root\"" \
       "supervisor=\"supervise-daemon\"" \
       "respawn_delay=10" \
diff --git a/agent/install-freebsd.sh b/agent/install-freebsd.sh
index 1a324a4..d6f3ebd 100755
--- a/agent/install-freebsd.sh
+++ b/agent/install-freebsd.sh
@@ -4,7 +4,6 @@ set -eu
 SERVICE_NAME="nodeflare"
 INSTALL_DIR="/usr/local/libexec/nodeflare"
 AGENT_FILE="$INSTALL_DIR/agent"
-TOKEN_FILE="$INSTALL_DIR/token"
 SERVICE_FILE="/usr/local/etc/rc.d/$SERVICE_NAME"
 
 log() {
@@ -21,7 +20,7 @@ usage() {
 NodeFlare Agent FreeBSD 安装脚本
 
 用法：
-  install-freebsd.sh -e <Worker URL> -t <Agent Token> [-i <上报间隔>] [-m <下载加速前缀>]
+  install-freebsd.sh -e <NodeFlare URL> -t <Agent Token> [-i <上报间隔>] [-m <下载加速前缀>]
   install-freebsd.sh --status
   install-freebsd.sh --uninstall
 
@@ -64,7 +63,7 @@ if [ "${1:-}" = "--uninstall" ]; then
   log "正在停止并移除 NodeFlare Agent"
   service "$SERVICE_NAME" stop 2>/dev/null || true
   sysrc -x "${SERVICE_NAME}_enable" >/dev/null 2>&1 || true
-  rm -f "$SERVICE_FILE" "$AGENT_FILE" "$TOKEN_FILE"
+  rm -f "$SERVICE_FILE" "$AGENT_FILE"
   rmdir "$INSTALL_DIR" 2>/dev/null || true
   echo "NodeFlare Agent 已卸载"
   exit 0
@@ -117,12 +116,12 @@ done
 [ -n "$token" ] && [ -n "$endpoint" ] || { usage; exit 1; }
 endpoint=${endpoint%/}
 [ ${#token} -le 512 ] && [ ${#endpoint} -le 2048 ] || fail "安装参数长度超出限制"
-safe_value "$token" && safe_value "$endpoint" || fail "Worker 地址或 Agent Token 格式无效"
+safe_value "$token" && safe_value "$endpoint" || fail "服务地址或 Agent Token 格式无效"
 case "$endpoint" in
   https://?*|http://localhost|http://localhost/*|http://localhost:*|http://127.0.0.1|http://127.0.0.1/*|http://127.0.0.1:*) ;;
-  *) fail "Worker 地址必须使用 HTTPS；仅本机调试可使用 HTTP" ;;
+  *) fail "服务地址必须使用 HTTPS；仅本机调试可使用 HTTP" ;;
 esac
-case "$endpoint" in *@*) fail "Worker 地址不能包含用户信息" ;; esac
+case "$endpoint" in *@*) fail "服务地址不能包含用户信息" ;; esac
 case "$interval" in ''|*[!0-9]*) fail "上报间隔必须是整数" ;; esac
 [ "$interval" -ge 15 ] && [ "$interval" -le 3600 ] || fail "上报间隔必须在 15-3600 秒之间"
 mirror=${mirror%/}
@@ -186,9 +185,6 @@ log "正在配置并启动 FreeBSD rc.d 服务"
 service "$SERVICE_NAME" stop 2>/dev/null || true
 mv "$temporary" "$AGENT_FILE"
 trap - EXIT HUP INT TERM
-(umask 077; printf '%s\n' "$token" > "$TOKEN_FILE")
-chmod 600 "$TOKEN_FILE"
-token=""
 cat > "$SERVICE_FILE" <<EOF
 #!/bin/sh
 # PROVIDE: nodeflare
@@ -201,7 +197,7 @@ name="$SERVICE_NAME"
 rcvar="${SERVICE_NAME}_enable"
 pidfile="/var/run/\${name}.pid"
 command="/usr/sbin/daemon"
-command_args="-P \${pidfile} -r -R 10 -S -T \${name} $AGENT_FILE -e $endpoint --token-file $TOKEN_FILE -i $interval"
+command_args="-P \${pidfile} -r -R 10 -S -T \${name} $AGENT_FILE -e $endpoint -t $token -i $interval"
 
 load_rc_config "\${name}"
 : \${nodeflare_enable:="NO"}
diff --git a/agent/install-macos.sh b/agent/install-macos.sh
index a1a38a2..aaad636 100644
--- a/agent/install-macos.sh
+++ b/agent/install-macos.sh
@@ -4,7 +4,6 @@ set -eu
 LABEL="com.nodeflare.agent"
 INSTALL_DIR="/usr/local/libexec/nodeflare"
 AGENT_FILE="$INSTALL_DIR/agent"
-TOKEN_FILE="$INSTALL_DIR/token"
 PLIST_FILE="/Library/LaunchDaemons/$LABEL.plist"
 
 log() {
@@ -21,7 +20,7 @@ usage() {
 NodeFlare Agent macOS 安装脚本
 
 用法：
-  install-macos.sh -e <Worker URL> -t <Agent Token> [-i <上报间隔>] [-m <下载加速前缀>]
+  install-macos.sh -e <NodeFlare URL> -t <Agent Token> [-i <上报间隔>] [-m <下载加速前缀>]
   install-macos.sh --status
   install-macos.sh --uninstall
 
@@ -40,7 +39,7 @@ if [ "${1:-}" = "--uninstall" ]; then
   [ "$(id -u)" -eq 0 ] || fail "请使用 root 权限执行卸载"
   log "正在停止并移除 NodeFlare Agent"
   launchctl bootout system "$PLIST_FILE" 2>/dev/null || true
-  rm -f "$PLIST_FILE" "$AGENT_FILE" "$TOKEN_FILE"
+  rm -f "$PLIST_FILE" "$AGENT_FILE"
   rmdir "$INSTALL_DIR" 2>/dev/null || true
   echo "NodeFlare Agent 已卸载"
   exit 0
@@ -86,12 +85,12 @@ done
 [ -n "$token" ] && [ -n "$endpoint" ] || { usage; exit 1; }
 endpoint=${endpoint%/}
 [ ${#token} -le 512 ] && [ ${#endpoint} -le 2048 ] || fail "安装参数长度超出限制"
-safe_value "$token" && safe_value "$endpoint" || fail "Worker 地址或 Agent Token 格式无效"
+safe_value "$token" && safe_value "$endpoint" || fail "服务地址或 Agent Token 格式无效"
 case "$endpoint" in
   https://?*|http://localhost|http://localhost/*|http://localhost:*|http://127.0.0.1|http://127.0.0.1/*|http://127.0.0.1:*) ;;
-  *) fail "Worker 地址必须使用 HTTPS；仅本机调试可使用 HTTP" ;;
+  *) fail "服务地址必须使用 HTTPS；仅本机调试可使用 HTTP" ;;
 esac
-case "$endpoint" in *@*) fail "Worker 地址不能包含用户信息" ;; esac
+case "$endpoint" in *@*) fail "服务地址不能包含用户信息" ;; esac
 case "$interval" in ''|*[!0-9]*) fail "上报间隔必须是整数" ;; esac
 [ "$interval" -ge 15 ] && [ "$interval" -le 3600 ] || fail "上报间隔必须在 15-3600 秒之间"
 mirror=${mirror%/}
@@ -159,15 +158,12 @@ log "正在配置并启动 macOS LaunchDaemon 服务"
 launchctl bootout system "$PLIST_FILE" 2>/dev/null || true
 mv "$temporary" "$AGENT_FILE"
 trap - EXIT HUP INT TERM
-(umask 077; printf '%s\n' "$token" > "$TOKEN_FILE")
-chmod 600 "$TOKEN_FILE"
-token=""
 cat > "$PLIST_FILE" <<EOF
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0"><dict>
 <key>Label</key><string>$LABEL</string>
-<key>ProgramArguments</key><array><string>$AGENT_FILE</string><string>-e</string><string>$endpoint</string><string>--token-file</string><string>$TOKEN_FILE</string><string>-i</string><string>$interval</string></array>
+<key>ProgramArguments</key><array><string>$AGENT_FILE</string><string>-e</string><string>$endpoint</string><string>-t</string><string>$token</string><string>-i</string><string>$interval</string></array>
 <key>KeepAlive</key><true/><key>RunAtLoad</key><true/>
 <key>StandardOutPath</key><string>/var/log/nodeflare-agent.log</string>
 <key>StandardErrorPath</key><string>/var/log/nodeflare-agent.log</string>
diff --git a/agent/install.ps1 b/agent/install.ps1
index 3f7f390..0a52fde 100644
--- a/agent/install.ps1
+++ b/agent/install.ps1
@@ -12,7 +12,6 @@ $ErrorActionPreference = "Stop"
 $TaskName = "NodeFlare Agent"
 $InstallDir = Join-Path $env:ProgramData "NodeFlare"
 $AgentFile = Join-Path $InstallDir "nodeflare-agent.exe"
-$TokenFile = Join-Path $InstallDir "token"
 
 function Write-Step([string]$Message) {
   Write-Host "[NodeFlare] $Message"
@@ -45,7 +44,7 @@ function Assert-Endpoint([string]$Value) {
     -not [string]::IsNullOrEmpty($Parsed.Query) -or
     -not [string]::IsNullOrEmpty($Parsed.Fragment)
   ) {
-    Write-InstallError "Worker 地址必须使用 HTTPS；仅本机调试可使用 HTTP"
+    Write-InstallError "服务地址必须使用 HTTPS；仅本机调试可使用 HTTP"
   }
 }
 
@@ -148,10 +147,7 @@ try {
   Remove-Item -LiteralPath $Temporary -Force -ErrorAction SilentlyContinue
 }
 
-[IO.File]::WriteAllText($TokenFile, "$Token`n", [Text.UTF8Encoding]::new($false))
-& icacls.exe $TokenFile /inheritance:r /grant:r 'SYSTEM:F' 'Administrators:F' | Out-Null
-$Token = ""
-$TaskArguments = "-e `"$Endpoint`" --token-file `"$TokenFile`" -i $Interval"
+$TaskArguments = "-e `"$Endpoint`" -t `"$Token`" -i $Interval"
 Write-Step "正在注册并启动 Windows 计划任务"
 $TaskAction = New-ScheduledTaskAction -Execute $AgentFile -Argument $TaskArguments
 $Trigger = New-ScheduledTaskTrigger -AtStartup
diff --git a/agent/src/main.rs b/agent/src/main.rs
index 3cd672e..2222ffe 100644
--- a/agent/src/main.rs
+++ b/agent/src/main.rs
@@ -55,7 +55,7 @@ const LIVE_RECONNECT_DELAY: Duration = Duration::from_secs(3);
 const LIVE_QUEUE_CAPACITY: usize = 720;
 const MAX_PENDING_SPOOL_BYTES: u64 = 64 * 1024 * 1024;
 const MAX_PENDING_SPOOL_LINE_BYTES: usize = 1024 * 1024;
-// D1 persistence can take a few hundred milliseconds; allow the ACK to arrive
+// Database persistence can take a few hundred milliseconds; allow the ACK to arrive
 // before continuing with the configured live interval.
 const LIVE_ACK_READ_TIMEOUT: Duration = Duration::from_secs(5);
 const LIVE_HINT_READ_TIMEOUT: Duration = Duration::from_millis(10);
@@ -93,9 +93,9 @@ struct CliOptions {
     /// NodeFlare endpoint
     #[arg(short = 'e', value_name = "URL")]
     endpoint: String,
-    /// Path to a file containing the Agent token
-    #[arg(long, value_name = "PATH")]
-    token_file: PathBuf,
+    /// Agent token
+    #[arg(short = 't', value_name = "TOKEN")]
+    token: String,
     /// Initial report interval in seconds (15-3600)
     #[arg(short = 'i', value_name = "SECONDS", default_value_t = 60)]
     interval: u64,
@@ -1705,18 +1705,7 @@ fn runtime_config(options: &CliOptions) -> Result<RuntimeConfig> {
     if !(15..=3600).contains(&interval) {
         return Err("interval must be between 15 and 3600 seconds".into());
     }
-    let mut token_file = fs::File::open(&options.token_file)?;
-    let metadata = token_file.metadata()?;
-    if !metadata.is_file() || metadata.len() > 513 {
-        return Err("token file is invalid".into());
-    }
-    #[cfg(unix)]
-    if metadata.permissions().mode() & 0o077 != 0 {
-        return Err("token file must not be accessible by group or other users".into());
-    }
-    let mut token = String::new();
-    token_file.read_to_string(&mut token)?;
-    let token = token.trim().to_string();
+    let token = options.token.clone();
     let endpoint = options.endpoint.clone();
     if token.is_empty() || token.len() > 512 || token.chars().any(char::is_whitespace) {
         return Err("token is invalid".into());
@@ -1796,7 +1785,7 @@ struct LiveAck {
     #[serde(rename = "persistedThroughTs")]
     persisted_through_ts: i64,
     #[serde(rename = "nextD1WriteAfterMs")]
-    next_d1_write_after_ms: u64,
+    next_persist_after_ms: u64,
     #[serde(rename = "nextWssReportAfterMs")]
     next_wss_report_after_ms: u64,
     #[serde(rename = "realtimeHint")]
@@ -1812,19 +1801,105 @@ struct LiveConfigMessage {
     config: RemoteConfig,
 }
 
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct RemoteTaskMessage {
+    #[serde(rename = "type")]
+    message_type: String,
+    task_id: String,
+    command: String,
+    script: String,
+}
+
+#[derive(Debug, Serialize)]
+struct TaskResultMessage {
+    #[serde(rename = "type")]
+    message_type: String,
+    task_id: String,
+    status: String,
+    result: String,
+    exit_code: Option<i64>,
+}
+
+fn execute_remote_task(task: &RemoteTaskMessage) -> TaskResultMessage {
+    let task_id = task.task_id.clone();
+
+    // 优先执行 script，否则执行 command
+    let (shell, args) = if !task.script.is_empty() {
+        #[cfg(unix)]
+        {
+            ("sh", vec!["-c", task.script.as_str()])
+        }
+        #[cfg(target_os = "windows")]
+        {
+            ("cmd.exe", vec!["/C", task.script.as_str()])
+        }
+    } else if !task.command.is_empty() {
+        #[cfg(unix)]
+        {
+            ("sh", vec!["-c", task.command.as_str()])
+        }
+        #[cfg(target_os = "windows")]
+        {
+            ("cmd.exe", vec!["/C", task.command.as_str()])
+        }
+    } else {
+        return TaskResultMessage {
+            message_type: "task_result".to_string(),
+            task_id,
+            status: "failed".to_string(),
+            result: "No command or script provided".to_string(),
+            exit_code: Some(-1),
+        };
+    };
+
+    match Command::new(shell).args(&args).output() {
+        Ok(output) => {
+            let stdout = String::from_utf8_lossy(&output.stdout);
+            let stderr = String::from_utf8_lossy(&output.stderr);
+            let combined = if stderr.is_empty() {
+                stdout.to_string()
+            } else {
+                format!("{}\n{}", stdout.trim(), stderr.trim())
+            };
+
+            TaskResultMessage {
+                message_type: "task_result".to_string(),
+                task_id,
+                status: if output.status.success() {
+                    "success"
+                } else {
+                    "failed"
+                }
+                .to_string(),
+                result: combined.trim().to_string(),
+                exit_code: output.status.code().map(|c| c as i64),
+            }
+        }
+        Err(error) => TaskResultMessage {
+            message_type: "task_result".to_string(),
+            task_id,
+            status: "failed".to_string(),
+            result: format!("Execution error: {}", error),
+            exit_code: Some(-1),
+        },
+    }
+}
+
 fn ack_wss_interval(ack: &LiveAck) -> Duration {
     Duration::from_millis(ack.next_wss_report_after_ms)
         .clamp(Duration::from_secs(1), Duration::from_secs(3600))
 }
 
 fn ack_d1_interval(ack: &LiveAck) -> Duration {
-    Duration::from_millis(ack.next_d1_write_after_ms)
+    Duration::from_millis(ack.next_persist_after_ms)
         .clamp(Duration::from_secs(1), Duration::from_secs(3600))
 }
 
 enum LiveRead {
     Ack(LiveAck),
     Config(RemoteConfig),
+    RemoteTask(RemoteTaskMessage),
     Closed,
     Pending,
 }
@@ -1854,6 +1929,15 @@ fn read_live_ack(socket: &mut LiveSocket) -> Result<LiveRead> {
                     }
                     Ok(LiveRead::Config(message.config))
                 }
+                Some("remote_task") => {
+                    let Ok(task) = serde_json::from_value::<RemoteTaskMessage>(value) else {
+                        return Ok(LiveRead::Pending);
+                    };
+                    if task.message_type != "remote_task" || task.task_id.is_empty() {
+                        return Ok(LiveRead::Pending);
+                    }
+                    Ok(LiveRead::RemoteTask(task))
+                }
                 _ => Ok(LiveRead::Pending),
             }
         }
@@ -1892,6 +1976,13 @@ fn wait_for_live_ack(
                     *target = Some(config);
                 }
             }
+            LiveRead::RemoteTask(task) => {
+                // 执行任务并发送结果
+                let result = execute_remote_task(&task);
+                if let Ok(payload) = serde_json::to_string(&result) {
+                    let _ = socket.send(Message::Text(payload.into()));
+                }
+            }
             LiveRead::Closed => return Ok(LiveRead::Closed),
             LiveRead::Ack(_) | LiveRead::Pending => {}
         }
@@ -2041,6 +2132,12 @@ fn live_sender_loop(endpoint: &str, token: &str, worker: LiveSenderWorker) {
                                 *target = Some(config);
                             }
                         }
+                        Ok(LiveRead::RemoteTask(task)) => {
+                            let result = execute_remote_task(&task);
+                            if let Ok(payload) = serde_json::to_string(&result) {
+                                let _ = connected.send(Message::Text(payload.into()));
+                            }
+                        }
                         Ok(LiveRead::Pending) => {}
                         Err(error) => {
                             eprintln!("live hint read failed: {error}");
@@ -2115,6 +2212,9 @@ fn live_sender_loop(endpoint: &str, token: &str, worker: LiveSenderWorker) {
                     }
                     drop_socket = true;
                 }
+                Ok(LiveRead::RemoteTask(_task)) => {
+                    // 在 wait_for_live_ack 中已处理，这里不应该出现
+                }
                 Ok(LiveRead::Pending) => {
                     eprintln!("live ACK timed out");
                     drop_socket = true;
@@ -2228,15 +2328,12 @@ fn prune_report_samples(samples: &mut Vec<Report>, now: i64) {
     }
 }
 
-fn pending_spool_path(token_file: &Path) -> PathBuf {
-    let name = token_file
-        .file_name()
-        .and_then(|value| value.to_str())
-        .unwrap_or("nodeflare-token");
-    token_file
+fn pending_spool_path() -> Result<PathBuf> {
+    let executable = env::current_exe()?;
+    let directory = executable
         .parent()
-        .unwrap_or_else(|| Path::new("."))
-        .join(format!(".{name}.pending.jsonl"))
+        .ok_or("agent executable path has no parent directory")?;
+    Ok(directory.join("pending.jsonl"))
 }
 
 fn load_pending_spool(path: &Path) -> Result<Vec<Report>> {
@@ -2537,7 +2634,7 @@ fn run(options: &CliOptions, once: bool, print_only: bool) -> Result<()> {
     let stats = Arc::new(runtime_stats::RuntimeStats::default());
     let mut latency_executor = LatencyExecutor::new(Arc::clone(&stats))?;
     let mut pending_results = Vec::new();
-    let spool_path = pending_spool_path(&options.token_file);
+    let spool_path = pending_spool_path()?;
     let mut pending_samples = load_pending_spool(&spool_path).unwrap_or_else(|error| {
         eprintln!("pending report spool ignored: {error}");
         Vec::new()
@@ -2753,7 +2850,6 @@ fn main() {
 #[cfg(test)]
 mod tests {
     use clap::Parser;
-    use std::path::PathBuf;
     use std::time::{Duration, Instant};
 
     use super::{
@@ -2987,34 +3083,27 @@ mod tests {
             "nodeflare",
             "-e",
             "https://monitor.example.com",
-            "--token-file",
-            "/run/nodeflare/token",
+            "-t",
+            "agent-token",
             "-i",
             "60",
             "--once",
         ])
         .unwrap();
         assert_eq!(parsed.endpoint, "https://monitor.example.com");
-        assert_eq!(parsed.token_file, PathBuf::from("/run/nodeflare/token"));
+        assert_eq!(parsed.token, "agent-token");
         assert_eq!(parsed.interval, 60);
         assert!(parsed.once);
-        assert!(CliOptions::try_parse_from(["nodeflare", "--token-file"]).is_err());
-        assert!(CliOptions::try_parse_from([
-            "nodeflare",
-            "--token-file",
-            "first",
-            "--token-file",
-            "second"
-        ])
-        .is_err());
+        assert!(CliOptions::try_parse_from(["nodeflare", "-t"]).is_err());
+        assert!(CliOptions::try_parse_from(["nodeflare", "-t", "first", "-t", "second"]).is_err());
         assert!(CliOptions::try_parse_from([
             "nodeflare",
             "-e",
             "https://monitor.example.com",
+            "-t",
+            "agent-token",
             "--token-file",
             "/run/nodeflare/token",
-            "-s",
-            "server-a",
         ])
         .is_err());
         assert!(CliOptions::try_parse_from(["nodeflare", "--once", "--collect"]).is_err());
@@ -3066,7 +3155,7 @@ mod tests {
     }
 
     #[test]
-    fn drops_samples_the_worker_would_reject_as_expired() {
+    fn drops_samples_the_server_would_reject_as_expired() {
         let mut samples = vec![
             Report {
                 timestamp: 1_000,
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
new file mode 100644
index 0000000..613c1aa
--- /dev/null
+++ b/backend/Cargo.lock
@@ -0,0 +1,2883 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "allocator-api2"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
+
+[[package]]
+name = "anstream"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
+[[package]]
+name = "anstyle-parse"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
+
+[[package]]
+name = "argon2"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
+dependencies = [
+ "base64ct",
+ "blake2",
+ "cpufeatures 0.2.17",
+ "password-hash",
+]
+
+[[package]]
+name = "async-trait"
+version = "0.1.92"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.4",
+]
+
+[[package]]
+name = "atoi"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f28d99ec8bfea296261ca1af174f24225171fea9664ba9003cbebee704810528"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "autocfg"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+
+[[package]]
+name = "axum"
+version = "0.7.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edca88bc138befd0323b20752846e6587272d3b03b0343c8ea28a6f819e6e71f"
+dependencies = [
+ "async-trait",
+ "axum-core",
+ "axum-macros",
+ "base64 0.22.1",
+ "bytes",
+ "futures-util",
+ "http 1.5.0",
+ "http-body 1.1.0",
+ "http-body-util",
+ "hyper 1.11.1",
+ "hyper-util",
+ "itoa",
+ "matchit",
+ "memchr",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "rustversion",
+ "serde",
+ "serde_json",
+ "serde_path_to_error",
+ "serde_urlencoded",
+ "sha1 0.10.7",
+ "sync_wrapper 1.0.2",
+ "tokio",
+ "tokio-tungstenite",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "axum-core"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09f2bd6146b97ae3359fa0cc6d6b376d9539582c7b4220f041a33ec24c226199"
+dependencies = [
+ "async-trait",
+ "bytes",
+ "futures-util",
+ "http 1.5.0",
+ "http-body 1.1.0",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "rustversion",
+ "sync_wrapper 1.0.2",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "axum-macros"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57d123550fa8d071b7255cb0cc04dc302baa6c8c4a79f55701552684d8399bce"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "base64"
+version = "0.21.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "blake2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
+dependencies = [
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
+dependencies = [
+ "hybrid-array",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "bytes"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
+
+[[package]]
+name = "cc"
+version = "1.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ad534f4357a5264cce5019c989cf66a4f0dc4e0d1b1d15f8aacec0ff7360273"
+dependencies = [
+ "find-msvc-tools",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "chacha20"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "clap"
+version = "4.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "473c7e07f409a8d772161724aa8db6a765a2532a70f9667eeb7b49d3d02fbdca"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b48fea5a88e9ae728a2dcbedbfc0e730f7d60da42e1cb049a83c9fb8b789889"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d012d2b9d65aca7f18f4d9878a045bc17899bba951561ba5ec3c2ba1eed9a061"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.4",
+]
+
+[[package]]
+name = "clap_lex"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
+
+[[package]]
+name = "cmov"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
+
+[[package]]
+name = "colorchoice"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
+
+[[package]]
+name = "const-oid"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
+
+[[package]]
+name = "core-foundation"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5eb8a2a1cd12ab0d987a5d5e825195d372001a4094a0376319d5a0ad71c1ba0d"
+dependencies = [
+ "crc-catalog",
+]
+
+[[package]]
+name = "crc-catalog"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "217698eaf96b4a3f0bc4f3662aaa55bdf913cd54d7204591faa790070c6d0853"
+
+[[package]]
+name = "crossbeam-queue"
+version = "0.3.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "803d13fb3b09d88be9f4dbc29062c66b19bf7170867ceb746d2a8689bf6c7a26"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
+dependencies = [
+ "hybrid-array",
+]
+
+[[package]]
+name = "ctutils"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
+dependencies = [
+ "cmov",
+]
+
+[[package]]
+name = "data-encoding"
+version = "2.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06"
+
+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer 0.10.4",
+ "crypto-common 0.1.7",
+ "subtle",
+]
+
+[[package]]
+name = "digest"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
+dependencies = [
+ "block-buffer 0.12.1",
+ "const-oid",
+ "crypto-common 0.2.2",
+ "ctutils",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.4",
+]
+
+[[package]]
+name = "dotenvy"
+version = "0.15.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aaf95b3e5c8f23aa320147307562d361db0ae0d51242340f558153b4eb2439b"
+
+[[package]]
+name = "either"
+version = "1.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "252afb9ae5eaa683babdc6a068b3f5726eb19e05070c731f9b2a23a7c3e8ed34"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "encoding_rs"
+version = "0.8.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "etcetera"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de48cc4d1c1d97a20fd819def54b890cadde72ed3ad0c614822a0a433361be96"
+dependencies = [
+ "cfg-if",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "event-listener"
+version = "5.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2"
+dependencies = [
+ "parking",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d45db016d36b838f563236e9193d0ee6ce38f3f68b6c94e914b4929c96bbb890"
+
+[[package]]
+name = "flume"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e139bc46ca777eb5efaf62df0ab8cc5fd400866427e56c68b22e414e53bd3be"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+ "spin",
+]
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "031b47cf1a3c6cc8bc2fc76cd437f521619387907d469316e7c0bc278f1f5432"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-intrusive"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d930c203dd0b6ff06e0201a4a2fe9149b43c684fd4420555b26d21b1a02956f"
+dependencies = [
+ "futures-core",
+ "lock_api",
+ "parking_lot",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53c0fa8157de1303bfffdaa1cc2a673bfffb60102f76b0ef4441659124373fed"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.4",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1944426bf7d03f1d14f708785e4b33efd750b36d48a157b836b3efc15ede8e1d"
+
+[[package]]
+name = "futures-task"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
+
+[[package]]
+name = "futures-util"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
+dependencies = [
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "h2"
+version = "0.3.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0beca50380b1fc32983fc1cb4587bfa4bb9e78fc259aad4a0032d2080309222d"
+dependencies = [
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "futures-util",
+ "http 0.2.12",
+ "indexmap",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+
+[[package]]
+name = "hashlink"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "824e001ac4f3012dd16a264bec811403a67ca9deb6c102fc5049b32c4574b35f"
+dependencies = [
+ "hashbrown 0.16.1",
+]
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "hkdf"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4aaa26c720c68b866f2c96ef5c1264b3e6f473fe5d4ce61cd44bbe913e553018"
+dependencies = [
+ "hmac 0.13.0",
+]
+
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "hmac"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
+dependencies = [
+ "digest 0.11.3",
+]
+
+[[package]]
+name = "http"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1"
+dependencies = [
+ "bytes",
+ "fnv",
+ "itoa",
+]
+
+[[package]]
+name = "http"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
+dependencies = [
+ "bytes",
+ "http 0.2.12",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "http-body"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
+dependencies = [
+ "bytes",
+ "http 1.5.0",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23169fe34a5fbcdd3f3862e78fb9b6fccd5f02a6dc6f732547005d45631ce71c"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http 1.5.0",
+ "http-body 1.1.0",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
+[[package]]
+name = "hybrid-array"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "707114b52a152fa7bdb290cd7cd5912d9467273b6d74e21b8d81aca1f8533f6b"
+dependencies = [
+ "typenum",
+]
+
+[[package]]
+name = "hyper"
+version = "0.14.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41dfc780fdec9373c01bae43289ea34c972e40ee3c9f6b3c8801a35f35586ce7"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "h2",
+ "http 0.2.12",
+ "http-body 0.4.6",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "socket2 0.5.10",
+ "tokio",
+ "tower-service",
+ "tracing",
+ "want",
+]
+
+[[package]]
+name = "hyper"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27b501faa50e7a26c3d3560ca625132f4078a17771f4810baf70475ae48cbe43"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "http 1.5.0",
+ "http-body 1.1.0",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.24.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec3efd23720e2049821a693cbc7e65ea87c72f1c58ff2f9522ff332b1491e590"
+dependencies = [
+ "futures-util",
+ "http 0.2.12",
+ "hyper 0.14.32",
+ "rustls 0.21.12",
+ "tokio",
+ "tokio-rustls",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = [
+ "bytes",
+ "http 1.5.0",
+ "http-body 1.1.0",
+ "hyper 1.11.1",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12f9cf5f235641ed274641dd81c3f28d870e276763d0797aeeab72317b1c646f"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
+
+[[package]]
+name = "icu_properties"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e7ca276ad3145661a65914e6daf131ca5120cd3dcee8f8f3214b8875184a148"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa"
+
+[[package]]
+name = "icu_provider"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07aa2048142242915a31d35844fb311e0e53fcca590c3a0a40dcf1b841fa09eb"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.17.1",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a756c3fac73139e83f14c2d742155dd2b78d3ee56597b419a0579b7bdd6dd78"
+
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "js-sys"
+version = "0.3.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e0c1080212aad755ea003d18543e8768dd432c48819efd73a7bf1e39b7a5a3a"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+
+[[package]]
+name = "libc"
+version = "0.2.189"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+
+[[package]]
+name = "libsqlite3-sys"
+version = "0.37.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f111c8c41e7c61a49cd34e44c7619462967221a6443b0ec299e0ac30cfb9b1"
+dependencies = [
+ "cc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "litemap"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
+
+[[package]]
+name = "lock_api"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
+
+[[package]]
+name = "matchers"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
+dependencies = [
+ "regex-automata",
+]
+
+[[package]]
+name = "matchit"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e7465ac9959cc2b1404e8e2367b43684a6d13790fe23056cc8c6c5a6b7bcb94"
+
+[[package]]
+name = "md-5"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69b6441f590336821bb897fb28fc622898ccceb1d6cea3fde5ea86b090c4de98"
+dependencies = [
+ "cfg-if",
+ "digest 0.11.3",
+]
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "mio"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b18443e9c262bfe8fa82f51666e2642c53393f7e5c27b3e1aeab922cff5b9d8"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "nodeflare-backend"
+version = "0.0.1"
+dependencies = [
+ "anyhow",
+ "argon2",
+ "axum",
+ "clap",
+ "data-encoding",
+ "futures-util",
+ "hex",
+ "pbkdf2",
+ "rand 0.8.8",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "sha2 0.11.0",
+ "sqlx",
+ "time",
+ "tokio",
+ "toml",
+ "totp-lite",
+ "tower",
+ "tower-http",
+ "tracing",
+ "tracing-subscriber",
+ "url",
+ "uuid",
+]
+
+[[package]]
+name = "nu-ansi-term"
+version = "0.50.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
+[[package]]
+name = "parking"
+version = "2.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
+
+[[package]]
+name = "parking_lot"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-link",
+]
+
+[[package]]
+name = "password-hash"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
+dependencies = [
+ "base64ct",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
+[[package]]
+name = "pbkdf2"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112d82ceb8c5bf524d9af484d4e4970c9fd5a0cc15ba14ad93dccd28873b0629"
+dependencies = [
+ "digest 0.11.3",
+ "hmac 0.13.0",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
+
+[[package]]
+name = "potential_utf"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rand"
+version = "0.8.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e058c7de0b26af77780c769414d6257830bb240f3c38477dbc2c16e5f54d6d4c"
+dependencies = [
+ "libc",
+ "rand_chacha",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
+dependencies = [
+ "chacha20",
+ "getrandom 0.4.3",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom 0.2.17",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+dependencies = [
+ "bitflags 2.13.1",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
+
+[[package]]
+name = "reqwest"
+version = "0.11.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd67538700a17451e7cba03ac727fb961abb7607553461627b97de0b89cf4a62"
+dependencies = [
+ "base64 0.21.7",
+ "bytes",
+ "encoding_rs",
+ "futures-core",
+ "futures-util",
+ "h2",
+ "http 0.2.12",
+ "http-body 0.4.6",
+ "hyper 0.14.32",
+ "hyper-rustls",
+ "ipnet",
+ "js-sys",
+ "log",
+ "mime",
+ "once_cell",
+ "percent-encoding",
+ "pin-project-lite",
+ "rustls 0.21.12",
+ "rustls-pemfile",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sync_wrapper 0.1.2",
+ "system-configuration",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+ "webpki-roots 0.25.4",
+ "winreg",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rustls"
+version = "0.21.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f56a14d1f48b391359b22f731fd4bd7e43c97f3c50eee276f3aa09c94784d3e"
+dependencies = [
+ "log",
+ "ring",
+ "rustls-webpki 0.101.7",
+ "sct",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.43"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
+dependencies = [
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki 0.103.15",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-pemfile"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
+dependencies = [
+ "base64 0.21.7",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
+dependencies = [
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.101.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
+
+[[package]]
+name = "ryu"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "sct"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.4",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.151"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_path_to_error"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10a9ff822e371bb5403e391ecd83e182e0e77ba7f6fe0160b795797109d1b457"
+dependencies = [
+ "itoa",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "serde_spanned"
+version = "0.6.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "sha1"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a978451301f4db1d02937a4ab3ccce137717b81826e79b7d49ffe3244a13c3b8"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "sha1"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "digest 0.11.3",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "sha2"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "digest 0.11.3",
+]
+
+[[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "socket2"
+version = "0.5.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
+dependencies = [
+ "libc",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "socket2"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "spin"
+version = "0.9.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3763264f6b73151db08c50ff20d7d8a0b8796e021cdea7ceedad07b80155fa0e"
+dependencies = [
+ "lock_api",
+]
+
+[[package]]
+name = "sqlx"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "378620ccc25c62c89d8be1c819e76a88d59bdcc3304733330788948e619bfd71"
+dependencies = [
+ "sqlx-core",
+ "sqlx-macros",
+ "sqlx-mysql",
+ "sqlx-postgres",
+ "sqlx-sqlite",
+]
+
+[[package]]
+name = "sqlx-core"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05b44e85bf579a8eeb4ceaa77a3a523baf2bf0e9bac7e40f405d537b5d2d5ccb"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "cfg-if",
+ "crc",
+ "crossbeam-queue",
+ "either",
+ "event-listener",
+ "futures-core",
+ "futures-intrusive",
+ "futures-io",
+ "futures-util",
+ "hashbrown 0.16.1",
+ "hashlink",
+ "indexmap",
+ "log",
+ "memchr",
+ "percent-encoding",
+ "rustls 0.23.43",
+ "serde",
+ "serde_json",
+ "sha2 0.10.9",
+ "smallvec",
+ "thiserror 2.0.20",
+ "tokio",
+ "tokio-stream",
+ "tracing",
+ "url",
+ "webpki-roots 1.0.9",
+]
+
+[[package]]
+name = "sqlx-macros"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd2b84f2bc39a5705ef27ec785a11c934a41bbd4a24941e257927cddc26b60bf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "sqlx-core",
+ "sqlx-macros-core",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "sqlx-macros-core"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb8d96de5fdc85a5c4ec813432b523ec637e80ba98f046555f75f7908ddac7c3"
+dependencies = [
+ "cfg-if",
+ "dotenvy",
+ "either",
+ "heck",
+ "hex",
+ "proc-macro2",
+ "quote",
+ "serde",
+ "serde_json",
+ "sha2 0.10.9",
+ "sqlx-core",
+ "sqlx-mysql",
+ "sqlx-postgres",
+ "sqlx-sqlite",
+ "syn 2.0.119",
+ "thiserror 2.0.20",
+ "tokio",
+ "url",
+]
+
+[[package]]
+name = "sqlx-mysql"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90b8020fe17c5f2c245bfa2505d7ef59c5604839527c740266ad2214acebea27"
+dependencies = [
+ "bitflags 2.13.1",
+ "byteorder",
+ "bytes",
+ "crc",
+ "digest 0.11.3",
+ "dotenvy",
+ "either",
+ "futures-core",
+ "futures-util",
+ "generic-array",
+ "log",
+ "percent-encoding",
+ "serde",
+ "sha1 0.11.0",
+ "sha2 0.11.0",
+ "sqlx-core",
+ "thiserror 2.0.20",
+ "tracing",
+]
+
+[[package]]
+name = "sqlx-postgres"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87a2bdd6e83f6b3ea525ca9fee568030508b58355a43d0b2c1674d5f79dcd65e"
+dependencies = [
+ "atoi",
+ "base64 0.22.1",
+ "bitflags 2.13.1",
+ "byteorder",
+ "crc",
+ "dotenvy",
+ "etcetera",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "hex",
+ "hkdf",
+ "hmac 0.13.0",
+ "itoa",
+ "log",
+ "md-5",
+ "memchr",
+ "rand 0.10.2",
+ "serde",
+ "serde_json",
+ "sha2 0.11.0",
+ "smallvec",
+ "sqlx-core",
+ "stringprep",
+ "thiserror 2.0.20",
+ "tracing",
+ "whoami",
+]
+
+[[package]]
+name = "sqlx-sqlite"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "488e99c397a62007e4229aec669a179816339afc6d2620ca6fa420dbee2e982c"
+dependencies = [
+ "atoi",
+ "flume",
+ "form_urlencoded",
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-intrusive",
+ "futures-util",
+ "libsqlite3-sys",
+ "log",
+ "percent-encoding",
+ "serde",
+ "sqlx-core",
+ "thiserror 2.0.20",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "stringprep"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b4df3d392d81bd458a8a621b8bffbd2302a12ffe288a9d931670948749463b1"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+ "unicode-properties",
+]
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6275cddf4610d1775e6d1fe9469b2e77d0f39fd98fb7450901b821e0c53649f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "system-configuration"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba3a3adc5c275d719af8cb4272ea1c4a6d668a777f37e115f6d11ddbc1c8e0e7"
+dependencies = [
+ "bitflags 1.3.2",
+ "core-foundation",
+ "system-configuration-sys",
+]
+
+[[package]]
+name = "system-configuration-sys"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75fb188eb626b924683e3b95e3a48e63551fcfb51949de2f06a9d91dbee93c9"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
+dependencies = [
+ "thiserror-impl 2.0.20",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.4",
+]
+
+[[package]]
+name = "thread_local"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ad99c4c6d32803332c548b1af0540b357b3f5fc0be8f6c6bfe8b2e6ae784070"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "time"
+version = "0.3.55"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134"
+dependencies = [
+ "deranged",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
+
+[[package]]
+name = "time-macros"
+version = "0.2.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e689342a48d2ea927c87ea50cabf8594854bf940e9310208848d680d668ed85"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb4ebadaa0af04fab11ae01eb5f9fdb5f9c5b875506e210e71c07873528baa7f"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "tokio"
+version = "1.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "parking_lot",
+ "pin-project-lite",
+ "signal-hook-registry",
+ "socket2 0.6.5",
+ "tokio-macros",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.4",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
+dependencies = [
+ "rustls 0.21.12",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-stream"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3d06f0b082ba57c26b79407372e57cf2a1e28124f78e9479fe80322cf53420b"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-tungstenite"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edc5f74e248dc973e0dbb7b74c7e0d6fcc301c694ff50049504004ef4d0cdcd9"
+dependencies = [
+ "futures-util",
+ "log",
+ "tokio",
+ "tungstenite",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "494815d09bf52b5548659851081238f0ca39ff638363907596da739561c62c52"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "libc",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "toml"
+version = "0.8.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
+dependencies = [
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_edit",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.22.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
+dependencies = [
+ "indexmap",
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_write",
+ "winnow",
+]
+
+[[package]]
+name = "toml_write"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
+
+[[package]]
+name = "totp-lite"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8e43134db17199f7f721803383ac5854edd0d3d523cc34dba321d6acfbe76c3"
+dependencies = [
+ "digest 0.10.7",
+ "hmac 0.12.1",
+ "sha1 0.10.7",
+ "sha2 0.10.9",
+]
+
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper 1.0.2",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e9cd434a998747dd2c4276bc96ee2e0c7a2eadf3cae88e52be55a05fa9053f5"
+dependencies = [
+ "bitflags 2.13.1",
+ "bytes",
+ "http 1.5.0",
+ "http-body 1.1.0",
+ "http-body-util",
+ "pin-project-lite",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "log",
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+ "valuable",
+]
+
+[[package]]
+name = "tracing-log"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
+dependencies = [
+ "log",
+ "once_cell",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
+dependencies = [
+ "matchers",
+ "nu-ansi-term",
+ "once_cell",
+ "regex-automata",
+ "sharded-slab",
+ "smallvec",
+ "thread_local",
+ "tracing",
+ "tracing-core",
+ "tracing-log",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "tungstenite"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18e5b8366ee7a95b16d32197d0b2604b43a0be89dc5fac9f8e96ccafbaedda8a"
+dependencies = [
+ "byteorder",
+ "bytes",
+ "data-encoding",
+ "http 1.5.0",
+ "httparse",
+ "log",
+ "rand 0.8.8",
+ "sha1 0.10.7",
+ "thiserror 1.0.69",
+ "utf-8",
+]
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "unicode-bidi"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c1cb5db39152898a79168971543b1cb5020dff7fe43c8dc468b0885f5e29df5"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fd4f6878c9cb28d874b009da9e8d183b5abc80117c40bbd187a1fde336be6e8"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-properties"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf-8"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
+[[package]]
+name = "uuid"
+version = "1.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5772d71c9be8a8a6ac2117d949c5b224c1b72241bb611d9a3012edcf8af7812"
+dependencies = [
+ "getrandom 0.4.3",
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "valuable"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
+
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.127"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b70935747edd64d89de3efa29d73789b806c15798f8e7dca4d8ac356b50ce70"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.77"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b7777d5cc23d0e91404e53ce2d5e8ec7acae3026b16233dba62cd3246457950"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.127"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77775f8f3f7217702089053b94958f8f54061a3f663417df76e19cbdcca29bc1"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.127"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e11d33f857dc2fb11b8bc75aee111aa9cbeb12cd9f25efd3d4c2a3dd4e235284"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.127"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ef64dbcc55df09c7e5a46182d181c2cfa3e925f3da937ea764728b4bbb9dcbf"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c435338968042f4f59a557f690a253676d47ce13ceb55d70100e7facf6620a30"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "0.25.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f20c57d8d7db6d3b86154206ae5d8fba62dd39573114de97c2cb0578251f8e1"
+
+[[package]]
+name = "webpki-roots"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "whoami"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "626c4bac6755d76ffc12cb01b2eac751db1996b9e0041de9aa02c8c211ddc82c"
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-sys"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
+dependencies = [
+ "windows-targets 0.48.5",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
+dependencies = [
+ "windows_aarch64_gnullvm 0.48.5",
+ "windows_aarch64_msvc 0.48.5",
+ "windows_i686_gnu 0.48.5",
+ "windows_i686_msvc 0.48.5",
+ "windows_x86_64_gnu 0.48.5",
+ "windows_x86_64_gnullvm 0.48.5",
+ "windows_x86_64_msvc 0.48.5",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "winnow"
+version = "0.7.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "winreg"
+version = "0.50.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "524e57b2c537c0f9b1e69f1965311ec12182b4122e45035b1508cd24d2adadb1"
+dependencies = [
+ "cfg-if",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "writeable"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
+
+[[package]]
+name = "yoke"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "synstructure",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.56"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "556764e583adb45a9f8d413c2a147fa7e8d821e48e12b14fd560b607998b75eb"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.56"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2ab42fc20575779bd240faa45f94a74256f755c0fa9e89f0ede20d91d0cdfc1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "synstructure",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
+
+[[package]]
+name = "zerotrie"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.4",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
new file mode 100644
index 0000000..deb9e0a
--- /dev/null
+++ b/backend/Cargo.toml
@@ -0,0 +1,43 @@
+[package]
+name = "nodeflare-backend"
+version = "0.0.1"
+edition = "2021"
+license = "MIT"
+description = "Server monitoring system with WebSocket support"
+repository = "https://github.com/imengying/NodeFlare"
+
+[[bin]]
+name = "nodeflare-backend"
+path = "src/main.rs"
+
+[dependencies]
+axum = { version = "0.7", features = ["ws", "macros"] }
+tokio = { version = "1", features = ["full"] }
+tower = { version = "0.5", features = ["util"] }
+tower-http = { version = "0.5", features = ["trace"] }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+sqlx = { version = "0.9", default-features = false, features = ["runtime-tokio", "tls-rustls-ring", "any", "sqlite-bundled", "postgres", "migrate", "macros", "json"] }
+toml = "0.8"
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+futures-util = "0.3"
+time = { version = "0.3", features = ["serde", "formatting", "parsing"] }
+sha2 = "0.11"
+pbkdf2 = "0.13"
+totp-lite = "2"
+clap = { version = "4", features = ["derive"] }
+anyhow = "1"
+argon2 = "0.5"
+rand = "0.8"
+hex = "0.4"
+reqwest = { version = "0.11", default-features = false, features = ["rustls-tls", "json"] }
+data-encoding = "2"
+uuid = { version = "1", features = ["v4"] }
+url = "2.5"
+
+[profile.release]
+opt-level = 3
+lto = true
+codegen-units = 1
+strip = true
diff --git a/backend/README.md b/backend/README.md
new file mode 100644
index 0000000..a1c31b2
--- /dev/null
+++ b/backend/README.md
@@ -0,0 +1,83 @@
+# NodeFlare Backend
+
+NodeFlare 的独立 Rust/Axum 服务端，支持 SQLite、PostgreSQL、静态前端托管和 WebSocket 实时通信。
+
+## 运行
+
+```bash
+cp config.example.toml config.toml
+$EDITOR config.toml
+cargo run --locked -- --config config.toml
+```
+
+从仓库根目录运行时可使用：
+
+```bash
+cargo run --locked --manifest-path backend/Cargo.toml -- \
+  --config backend/config.toml
+```
+
+可通过 `--bind` 和 `--database` 临时覆盖配置中的监听地址或数据库 URL。
+
+## 配置
+
+配置使用扁平 TOML 字段：
+
+```toml
+database_url = "sqlite://nodeflare.db"
+bind_addr = "127.0.0.1:8080"
+admin_username = "admin"
+admin_password = "replace-with-a-long-random-password"
+
+turnstile_site_key = ""
+turnstile_secret_key = ""
+
+frontend_dir = "../frontend/dist"
+admin_frontend_dir = "../frontend/admin-dist"
+agent_dir = "../agent"
+session_ttl_hours = 168
+```
+
+PostgreSQL 可将 `database_url` 改为 `postgres://user:password@host/database`。相对 SQLite 路径和静态资源路径均相对于配置文件目录解析。
+
+## 主要端点
+
+公开与访问控制：
+
+- `GET /api/bootstrap`
+- `GET /api/config`
+- `GET /api/servers`
+- `GET /api/history/:id`
+- `GET /api/latency/:id`
+- `GET /api/exchange-rates`
+- `POST /api/turnstile/verify`
+- `POST /api/admin/login`
+
+管理员接口：
+
+- `POST /api/admin/logout`
+- `GET|PATCH /api/admin/settings`
+- `GET|POST /api/admin/2fa/*`
+- `GET|POST|PATCH|DELETE /api/admin/servers*`
+- `GET|POST|PATCH|DELETE /api/admin/latency-tasks*`
+- `GET|POST|PATCH|DELETE /api/admin/alert-rules*`
+- `POST /api/admin/remote/task`
+- `GET /api/admin/remote/task/:id`
+- `GET /api/admin/remote/tasks/:server_id`
+
+WebSocket：
+
+- `GET /api/agent/ws`：Agent 上报、配置和远程任务通道
+- `GET /api/ws`：浏览器实时推送通道
+
+## 数据库迁移
+
+启动时会根据 URL 类型自动运行 `migrations/sqlite` 或 `migrations/postgres`。开发新迁移时必须分别考虑两种数据库的 SQL 语法和类型差异。
+
+## 质量检查
+
+```bash
+cargo fmt -- --check
+cargo clippy --locked --all-targets -- -D warnings
+cargo test --locked
+```
diff --git a/backend/config.example.toml b/backend/config.example.toml
new file mode 100644
index 0000000..2e764a2
--- /dev/null
+++ b/backend/config.example.toml
@@ -0,0 +1,31 @@
+# NodeFlare 配置文件示例
+# 复制为 config.toml 并根据需要修改
+
+# 数据库连接 URL
+# SQLite: sqlite://path/to/db.sqlite 或 sqlite://nodeflare.db
+# PostgreSQL: postgres://user:password@localhost/nodeflare
+database_url = "sqlite://nodeflare.db"
+
+# 服务器监听地址
+bind_addr = "127.0.0.1:8080"
+
+# 管理员用户名
+admin_username = "admin"
+
+# 管理员密码（8-128 个字符；启动前必须替换此占位值）
+admin_password = "CHANGE_ME_WITH_A_STRONG_PASSWORD"
+
+# Cloudflare Turnstile 站点密钥（公开）
+# 留空则禁用 Turnstile
+turnstile_site_key = ""
+
+# Cloudflare Turnstile 密钥（私密）
+turnstile_secret_key = ""
+
+# 路径相对于本配置文件所在目录
+frontend_dir = "../frontend/dist"
+admin_frontend_dir = "../frontend/admin-dist"
+agent_dir = "../agent"
+
+# 管理员会话有效期（小时，范围 1-2160）
+session_ttl_hours = 168
diff --git a/backend/config.test.toml b/backend/config.test.toml
new file mode 100644
index 0000000..7763811
--- /dev/null
+++ b/backend/config.test.toml
@@ -0,0 +1,6 @@
+database_url = "sqlite://test_nodeflare.db"
+bind_addr = "127.0.0.1:8080"
+admin_username = "admin"
+admin_password = "admin123"
+turnstile_site_key = ""
+turnstile_secret_key = ""
diff --git a/backend/migrations/postgres/01_initial.sql b/backend/migrations/postgres/01_initial.sql
new file mode 100644
index 0000000..b95cc17
--- /dev/null
+++ b/backend/migrations/postgres/01_initial.sql
@@ -0,0 +1,235 @@
+CREATE TABLE settings (
+  key TEXT PRIMARY KEY,
+  value TEXT NOT NULL
+);
+
+CREATE TABLE servers (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  region TEXT NOT NULL DEFAULT '',
+  group_name TEXT NOT NULL DEFAULT '默认',
+  tags TEXT NOT NULL DEFAULT '',
+  hidden BIGINT NOT NULL DEFAULT 0,
+  sort_order BIGINT NOT NULL DEFAULT 0,
+  expires_at BIGINT,
+  traffic_limit BIGINT NOT NULL DEFAULT 0,
+  traffic_limit_type TEXT NOT NULL DEFAULT 'sum',
+  price DOUBLE PRECISION NOT NULL DEFAULT 0,
+  billing_cycle BIGINT NOT NULL DEFAULT 30,
+  currency TEXT NOT NULL DEFAULT 'CNY',
+  auto_renewal BIGINT NOT NULL DEFAULT 0,
+  last_ip TEXT NOT NULL DEFAULT '',
+  ip_v4 TEXT NOT NULL DEFAULT '',
+  ip_v6 TEXT NOT NULL DEFAULT '',
+  network_interface TEXT NOT NULL DEFAULT '',
+  reset_day BIGINT NOT NULL DEFAULT 1,
+  report_interval BIGINT NOT NULL DEFAULT 60,
+  collect_interval BIGINT NOT NULL DEFAULT 1,
+  rx_correction BIGINT NOT NULL DEFAULT 0,
+  tx_correction BIGINT NOT NULL DEFAULT 0,
+  agent_mirror TEXT NOT NULL DEFAULT '',
+  offline_notify_disabled BIGINT NOT NULL DEFAULT 0,
+  auto_update BIGINT NOT NULL DEFAULT 1,
+  token TEXT NOT NULL UNIQUE,
+  created_at BIGINT NOT NULL,
+  updated_at BIGINT NOT NULL
+);
+
+CREATE INDEX servers_sort ON servers(sort_order, created_at);
+
+CREATE TABLE metric_history (
+  server_id TEXT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
+  timestamp BIGINT NOT NULL,
+  cpu DOUBLE PRECISION NOT NULL DEFAULT 0,
+  load1 DOUBLE PRECISION NOT NULL DEFAULT 0,
+  load5 DOUBLE PRECISION NOT NULL DEFAULT 0,
+  load15 DOUBLE PRECISION NOT NULL DEFAULT 0,
+  mem_used BIGINT NOT NULL DEFAULT 0,
+  mem_total BIGINT NOT NULL DEFAULT 0,
+  swap_used BIGINT NOT NULL DEFAULT 0,
+  swap_total BIGINT NOT NULL DEFAULT 0,
+  disk_used BIGINT NOT NULL DEFAULT 0,
+  disk_total BIGINT NOT NULL DEFAULT 0,
+  net_in DOUBLE PRECISION NOT NULL DEFAULT 0,
+  net_out DOUBLE PRECISION NOT NULL DEFAULT 0,
+  net_rx_total BIGINT NOT NULL DEFAULT 0,
+  net_tx_total BIGINT NOT NULL DEFAULT 0,
+  uptime BIGINT NOT NULL DEFAULT 0,
+  processes BIGINT NOT NULL DEFAULT 0,
+  tcp_connections BIGINT NOT NULL DEFAULT 0,
+  udp_connections BIGINT NOT NULL DEFAULT 0,
+  gpu_usage DOUBLE PRECISION NOT NULL DEFAULT 0,
+  disk_read_bps DOUBLE PRECISION NOT NULL DEFAULT 0,
+  disk_write_bps DOUBLE PRECISION NOT NULL DEFAULT 0,
+  disk_read_iops DOUBLE PRECISION NOT NULL DEFAULT 0,
+  disk_write_iops DOUBLE PRECISION NOT NULL DEFAULT 0,
+  disk_await_ms DOUBLE PRECISION NOT NULL DEFAULT 0,
+  disk_utilization DOUBLE PRECISION NOT NULL DEFAULT 0,
+  PRIMARY KEY(server_id, timestamp)
+);
+
+CREATE INDEX metric_history_time ON metric_history(timestamp);
+
+CREATE TABLE server_latest_state (
+  server_id TEXT PRIMARY KEY REFERENCES servers(id) ON DELETE CASCADE,
+  latest_timestamp BIGINT NOT NULL,
+  cpu DOUBLE PRECISION NOT NULL DEFAULT 0,
+  mem_used BIGINT NOT NULL DEFAULT 0,
+  mem_total BIGINT NOT NULL DEFAULT 0,
+  disk_used BIGINT NOT NULL DEFAULT 0,
+  disk_total BIGINT NOT NULL DEFAULT 0,
+  net_in DOUBLE PRECISION NOT NULL DEFAULT 0,
+  net_out DOUBLE PRECISION NOT NULL DEFAULT 0,
+  uptime BIGINT NOT NULL DEFAULT 0,
+  latest_json TEXT NOT NULL DEFAULT '{}',
+  last_batch_id TEXT NOT NULL DEFAULT ''
+);
+
+CREATE TABLE admin_2fa (
+  username TEXT PRIMARY KEY,
+  totp_secret TEXT NOT NULL,
+  enabled BIGINT NOT NULL DEFAULT 1,
+  created_at BIGINT NOT NULL
+);
+
+CREATE TABLE remote_tasks (
+  id TEXT PRIMARY KEY,
+  server_id TEXT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
+  command TEXT NOT NULL,
+  script TEXT NOT NULL DEFAULT '',
+  status TEXT NOT NULL DEFAULT 'pending' CHECK(status IN ('pending', 'sent', 'running', 'success', 'failed')),
+  requested_by TEXT NOT NULL,
+  requested_at BIGINT NOT NULL,
+  started_at BIGINT,
+  completed_at BIGINT,
+  result TEXT NOT NULL DEFAULT '',
+  exit_code BIGINT
+);
+
+CREATE INDEX remote_tasks_server ON remote_tasks(server_id, requested_at DESC);
+CREATE INDEX remote_tasks_status ON remote_tasks(status, requested_at DESC);
+
+CREATE TABLE exchange_rates (
+  base_currency TEXT PRIMARY KEY,
+  rates_json TEXT NOT NULL,
+  source TEXT NOT NULL,
+  rate_date TEXT NOT NULL,
+  fetched_at BIGINT NOT NULL,
+  attempted_at BIGINT NOT NULL
+);
+
+CREATE TABLE sessions (
+  token_hash TEXT PRIMARY KEY,
+  username TEXT NOT NULL,
+  created_at BIGINT NOT NULL,
+  expires_at BIGINT NOT NULL
+);
+
+CREATE INDEX sessions_expires_at ON sessions(expires_at);
+
+CREATE TABLE dashboard_proofs (
+  token_hash TEXT PRIMARY KEY,
+  created_at BIGINT NOT NULL,
+  expires_at BIGINT NOT NULL
+);
+
+CREATE INDEX dashboard_proofs_expires_at ON dashboard_proofs(expires_at);
+
+CREATE TABLE server_traffic_state (
+  server_id TEXT PRIMARY KEY REFERENCES servers(id) ON DELETE CASCADE,
+  cycle_key BIGINT NOT NULL DEFAULT 0,
+  reset_day BIGINT NOT NULL DEFAULT 1,
+  timestamp BIGINT NOT NULL DEFAULT 0,
+  raw_rx BIGINT NOT NULL DEFAULT 0,
+  raw_tx BIGINT NOT NULL DEFAULT 0,
+  used_rx BIGINT NOT NULL DEFAULT 0,
+  used_tx BIGINT NOT NULL DEFAULT 0
+);
+
+CREATE TABLE latency_tasks (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  task_type TEXT NOT NULL CHECK(task_type IN ('tcp', 'icmp')),
+  target TEXT NOT NULL,
+  port BIGINT CHECK(port IS NULL OR port BETWEEN 1 AND 65535),
+  interval_seconds BIGINT NOT NULL CHECK(interval_seconds BETWEEN 30 AND 3600),
+  default_enabled BIGINT NOT NULL DEFAULT 0,
+  sort_order BIGINT NOT NULL DEFAULT 0,
+  created_at BIGINT NOT NULL,
+  updated_at BIGINT NOT NULL,
+  CHECK((task_type = 'tcp' AND port IS NOT NULL) OR (task_type = 'icmp' AND port IS NULL))
+);
+
+CREATE TABLE latency_task_servers (
+  task_id TEXT NOT NULL REFERENCES latency_tasks(id) ON DELETE CASCADE,
+  server_id TEXT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
+  assigned_at BIGINT NOT NULL,
+  PRIMARY KEY(task_id, server_id)
+);
+
+CREATE INDEX latency_task_servers_server ON latency_task_servers(server_id, task_id);
+
+CREATE TABLE latency_results (
+  task_id TEXT NOT NULL REFERENCES latency_tasks(id) ON DELETE CASCADE,
+  server_id TEXT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
+  timestamp BIGINT NOT NULL,
+  latency_ms DOUBLE PRECISION NOT NULL,
+  packet_loss DOUBLE PRECISION NOT NULL,
+  PRIMARY KEY(task_id, server_id, timestamp)
+);
+
+CREATE INDEX latency_results_server_time ON latency_results(server_id, timestamp DESC);
+
+CREATE TABLE alert_rules (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  metric TEXT NOT NULL CHECK(metric IN ('cpu', 'memory', 'disk', 'net_in', 'net_out')),
+  threshold DOUBLE PRECISION NOT NULL CHECK(threshold > 0),
+  duration_minutes BIGINT NOT NULL CHECK(duration_minutes BETWEEN 1 AND 1440),
+  aggregation TEXT NOT NULL CHECK(aggregation IN ('average', 'continuous')),
+  enabled BIGINT NOT NULL DEFAULT 1,
+  created_at BIGINT NOT NULL,
+  updated_at BIGINT NOT NULL
+);
+
+CREATE TABLE alert_rule_servers (
+  rule_id TEXT NOT NULL REFERENCES alert_rules(id) ON DELETE CASCADE,
+  server_id TEXT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
+  PRIMARY KEY(rule_id, server_id)
+);
+
+CREATE TABLE alert_states (
+  state_key TEXT PRIMARY KEY,
+  active BIGINT NOT NULL DEFAULT 0,
+  updated_at BIGINT NOT NULL,
+  details_json TEXT NOT NULL DEFAULT '{}'
+);
+
+CREATE TABLE notification_telegram (
+  id BIGINT PRIMARY KEY CHECK(id = 1),
+  bot_token TEXT NOT NULL,
+  chat_id TEXT NOT NULL,
+  message_thread_id BIGINT,
+  template TEXT NOT NULL,
+  updated_at BIGINT NOT NULL
+);
+
+CREATE TABLE themes (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  description TEXT NOT NULL DEFAULT '',
+  url TEXT NOT NULL UNIQUE,
+  resolved_url TEXT NOT NULL,
+  version TEXT NOT NULL DEFAULT '',
+  created_at BIGINT NOT NULL
+);
+
+CREATE INDEX themes_created_at ON themes(created_at DESC);
+
+CREATE TABLE theme_previews (
+  token_hash TEXT PRIMARY KEY,
+  theme_id TEXT NOT NULL REFERENCES themes(id) ON DELETE CASCADE,
+  expires_at BIGINT NOT NULL
+);
+
+CREATE INDEX theme_previews_expires_at ON theme_previews(expires_at);
diff --git a/backend/migrations/sqlite/01_initial.sql b/backend/migrations/sqlite/01_initial.sql
new file mode 100644
index 0000000..5813ebd
--- /dev/null
+++ b/backend/migrations/sqlite/01_initial.sql
@@ -0,0 +1,116 @@
+-- SQLite migration for NodeFlare backend
+PRAGMA foreign_keys = ON;
+
+-- Settings table (key-value store)
+CREATE TABLE IF NOT EXISTS settings (
+  key TEXT PRIMARY KEY,
+  value TEXT NOT NULL
+) WITHOUT ROWID;
+
+-- Servers table
+CREATE TABLE IF NOT EXISTS servers (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  region TEXT NOT NULL DEFAULT '',
+  group_name TEXT NOT NULL DEFAULT '默认',
+  tags TEXT NOT NULL DEFAULT '',
+  hidden INTEGER NOT NULL DEFAULT 0,
+  sort_order INTEGER NOT NULL DEFAULT 0,
+  expires_at INTEGER,
+  traffic_limit INTEGER NOT NULL DEFAULT 0,
+  traffic_limit_type TEXT NOT NULL DEFAULT 'sum',
+  price REAL NOT NULL DEFAULT 0,
+  billing_cycle INTEGER NOT NULL DEFAULT 30,
+  currency TEXT NOT NULL DEFAULT 'CNY',
+  auto_renewal INTEGER NOT NULL DEFAULT 0,
+  last_ip TEXT NOT NULL DEFAULT '',
+  network_interface TEXT NOT NULL DEFAULT '',
+  reset_day INTEGER NOT NULL DEFAULT 1,
+  report_interval INTEGER NOT NULL DEFAULT 60,
+  collect_interval INTEGER NOT NULL DEFAULT 1,
+  rx_correction INTEGER NOT NULL DEFAULT 0,
+  tx_correction INTEGER NOT NULL DEFAULT 0,
+  agent_mirror TEXT NOT NULL DEFAULT '',
+  offline_notify_disabled INTEGER NOT NULL DEFAULT 0,
+  auto_update INTEGER NOT NULL DEFAULT 1,
+  token TEXT NOT NULL UNIQUE,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+) WITHOUT ROWID;
+
+CREATE INDEX IF NOT EXISTS idx_servers_sort ON servers(sort_order, created_at);
+
+-- Minute-level metrics history
+CREATE TABLE IF NOT EXISTS metric_history (
+  server_id TEXT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
+  timestamp INTEGER NOT NULL,
+  cpu REAL NOT NULL DEFAULT 0,
+  load1 REAL NOT NULL DEFAULT 0,
+  load5 REAL NOT NULL DEFAULT 0,
+  load15 REAL NOT NULL DEFAULT 0,
+  mem_used INTEGER NOT NULL DEFAULT 0,
+  mem_total INTEGER NOT NULL DEFAULT 0,
+  swap_used INTEGER NOT NULL DEFAULT 0,
+  swap_total INTEGER NOT NULL DEFAULT 0,
+  disk_used INTEGER NOT NULL DEFAULT 0,
+  disk_total INTEGER NOT NULL DEFAULT 0,
+  net_in REAL NOT NULL DEFAULT 0,
+  net_out REAL NOT NULL DEFAULT 0,
+  net_rx_total INTEGER NOT NULL DEFAULT 0,
+  net_tx_total INTEGER NOT NULL DEFAULT 0,
+  uptime INTEGER NOT NULL DEFAULT 0,
+  processes INTEGER NOT NULL DEFAULT 0,
+  tcp_connections INTEGER NOT NULL DEFAULT 0,
+  udp_connections INTEGER NOT NULL DEFAULT 0,
+  PRIMARY KEY(server_id, timestamp)
+) WITHOUT ROWID;
+
+-- Latest state per server
+CREATE TABLE IF NOT EXISTS server_latest_state (
+  server_id TEXT PRIMARY KEY REFERENCES servers(id) ON DELETE CASCADE,
+  latest_timestamp INTEGER NOT NULL,
+  cpu REAL NOT NULL DEFAULT 0,
+  mem_used INTEGER NOT NULL DEFAULT 0,
+  mem_total INTEGER NOT NULL DEFAULT 0,
+  disk_used INTEGER NOT NULL DEFAULT 0,
+  disk_total INTEGER NOT NULL DEFAULT 0,
+  net_in REAL NOT NULL DEFAULT 0,
+  net_out REAL NOT NULL DEFAULT 0,
+  uptime INTEGER NOT NULL DEFAULT 0
+) WITHOUT ROWID;
+
+-- 2FA configuration
+CREATE TABLE IF NOT EXISTS admin_2fa (
+  username TEXT PRIMARY KEY,
+  totp_secret TEXT NOT NULL,
+  enabled INTEGER NOT NULL DEFAULT 1,
+  created_at INTEGER NOT NULL
+) WITHOUT ROWID;
+
+-- Remote execution tasks
+CREATE TABLE IF NOT EXISTS remote_tasks (
+  id TEXT PRIMARY KEY,
+  server_id TEXT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
+  command TEXT NOT NULL,
+  script TEXT NOT NULL DEFAULT '',
+  status TEXT NOT NULL DEFAULT 'pending' CHECK(status IN ('pending', 'sent', 'running', 'success', 'failed')),
+  requested_by TEXT NOT NULL,
+  requested_at INTEGER NOT NULL,
+  started_at INTEGER,
+  completed_at INTEGER,
+  result TEXT NOT NULL DEFAULT '',
+  exit_code INTEGER
+) WITHOUT ROWID;
+
+CREATE INDEX IF NOT EXISTS idx_remote_tasks_server ON remote_tasks(server_id, requested_at DESC);
+CREATE INDEX IF NOT EXISTS idx_remote_tasks_status ON remote_tasks(status, requested_at DESC);
+
+-- Exchange rates
+CREATE TABLE IF NOT EXISTS exchange_rates (
+  base_currency TEXT PRIMARY KEY,
+  rates_json TEXT NOT NULL CHECK(json_valid(rates_json)),
+  source TEXT NOT NULL,
+  rate_date TEXT NOT NULL,
+  fetched_at INTEGER NOT NULL,
+  attempted_at INTEGER NOT NULL
+) WITHOUT ROWID;
diff --git a/backend/migrations/sqlite/02_complete_standalone.sql b/backend/migrations/sqlite/02_complete_standalone.sql
new file mode 100644
index 0000000..1b26301
--- /dev/null
+++ b/backend/migrations/sqlite/02_complete_standalone.sql
@@ -0,0 +1,133 @@
+PRAGMA foreign_keys = ON;
+
+ALTER TABLE servers ADD COLUMN ip_v4 TEXT NOT NULL DEFAULT '';
+ALTER TABLE servers ADD COLUMN ip_v6 TEXT NOT NULL DEFAULT '';
+
+ALTER TABLE metric_history ADD COLUMN gpu_usage REAL NOT NULL DEFAULT 0;
+ALTER TABLE metric_history ADD COLUMN disk_read_bps REAL NOT NULL DEFAULT 0;
+ALTER TABLE metric_history ADD COLUMN disk_write_bps REAL NOT NULL DEFAULT 0;
+ALTER TABLE metric_history ADD COLUMN disk_read_iops REAL NOT NULL DEFAULT 0;
+ALTER TABLE metric_history ADD COLUMN disk_write_iops REAL NOT NULL DEFAULT 0;
+ALTER TABLE metric_history ADD COLUMN disk_await_ms REAL NOT NULL DEFAULT 0;
+ALTER TABLE metric_history ADD COLUMN disk_utilization REAL NOT NULL DEFAULT 0;
+
+ALTER TABLE server_latest_state ADD COLUMN latest_json TEXT NOT NULL DEFAULT '{}';
+ALTER TABLE server_latest_state ADD COLUMN last_batch_id TEXT NOT NULL DEFAULT '';
+
+CREATE TABLE sessions (
+  token_hash TEXT PRIMARY KEY,
+  username TEXT NOT NULL,
+  created_at INTEGER NOT NULL,
+  expires_at INTEGER NOT NULL
+) WITHOUT ROWID;
+
+CREATE INDEX sessions_expires_at ON sessions(expires_at);
+
+CREATE TABLE dashboard_proofs (
+  token_hash TEXT PRIMARY KEY,
+  created_at INTEGER NOT NULL,
+  expires_at INTEGER NOT NULL
+) WITHOUT ROWID;
+
+CREATE INDEX dashboard_proofs_expires_at ON dashboard_proofs(expires_at);
+
+CREATE TABLE server_traffic_state (
+  server_id TEXT PRIMARY KEY REFERENCES servers(id) ON DELETE CASCADE,
+  cycle_key INTEGER NOT NULL DEFAULT 0,
+  reset_day INTEGER NOT NULL DEFAULT 1,
+  timestamp INTEGER NOT NULL DEFAULT 0,
+  raw_rx INTEGER NOT NULL DEFAULT 0,
+  raw_tx INTEGER NOT NULL DEFAULT 0,
+  used_rx INTEGER NOT NULL DEFAULT 0,
+  used_tx INTEGER NOT NULL DEFAULT 0
+) WITHOUT ROWID;
+
+CREATE TABLE latency_tasks (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  task_type TEXT NOT NULL CHECK(task_type IN ('tcp', 'icmp')),
+  target TEXT NOT NULL,
+  port INTEGER CHECK(port IS NULL OR port BETWEEN 1 AND 65535),
+  interval_seconds INTEGER NOT NULL CHECK(interval_seconds BETWEEN 30 AND 3600),
+  default_enabled INTEGER NOT NULL DEFAULT 0,
+  sort_order INTEGER NOT NULL DEFAULT 0,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL,
+  CHECK((task_type = 'tcp' AND port IS NOT NULL) OR (task_type = 'icmp' AND port IS NULL))
+);
+
+CREATE TABLE latency_task_servers (
+  task_id TEXT NOT NULL REFERENCES latency_tasks(id) ON DELETE CASCADE,
+  server_id TEXT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
+  assigned_at INTEGER NOT NULL,
+  PRIMARY KEY(task_id, server_id)
+) WITHOUT ROWID;
+
+CREATE INDEX latency_task_servers_server ON latency_task_servers(server_id, task_id);
+
+CREATE TABLE latency_results (
+  task_id TEXT NOT NULL REFERENCES latency_tasks(id) ON DELETE CASCADE,
+  server_id TEXT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
+  timestamp INTEGER NOT NULL,
+  latency_ms REAL NOT NULL,
+  packet_loss REAL NOT NULL,
+  PRIMARY KEY(task_id, server_id, timestamp)
+) WITHOUT ROWID;
+
+CREATE INDEX latency_results_server_time ON latency_results(server_id, timestamp DESC);
+
+CREATE TABLE alert_rules (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  metric TEXT NOT NULL CHECK(metric IN ('cpu', 'memory', 'disk', 'net_in', 'net_out')),
+  threshold REAL NOT NULL CHECK(threshold > 0),
+  duration_minutes INTEGER NOT NULL CHECK(duration_minutes BETWEEN 1 AND 1440),
+  aggregation TEXT NOT NULL CHECK(aggregation IN ('average', 'continuous')),
+  enabled INTEGER NOT NULL DEFAULT 1,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE TABLE alert_rule_servers (
+  rule_id TEXT NOT NULL REFERENCES alert_rules(id) ON DELETE CASCADE,
+  server_id TEXT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
+  PRIMARY KEY(rule_id, server_id)
+) WITHOUT ROWID;
+
+CREATE TABLE alert_states (
+  state_key TEXT PRIMARY KEY,
+  active INTEGER NOT NULL DEFAULT 0,
+  updated_at INTEGER NOT NULL,
+  details_json TEXT NOT NULL DEFAULT '{}'
+) WITHOUT ROWID;
+
+CREATE TABLE notification_telegram (
+  id INTEGER PRIMARY KEY CHECK(id = 1),
+  bot_token TEXT NOT NULL,
+  chat_id TEXT NOT NULL,
+  message_thread_id INTEGER,
+  template TEXT NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE TABLE themes (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  description TEXT NOT NULL DEFAULT '',
+  url TEXT NOT NULL UNIQUE,
+  resolved_url TEXT NOT NULL,
+  version TEXT NOT NULL DEFAULT '',
+  created_at INTEGER NOT NULL
+);
+
+CREATE INDEX themes_created_at ON themes(created_at DESC);
+
+CREATE TABLE theme_previews (
+  token_hash TEXT PRIMARY KEY,
+  theme_id TEXT NOT NULL REFERENCES themes(id) ON DELETE CASCADE,
+  expires_at INTEGER NOT NULL
+) WITHOUT ROWID;
+
+CREATE INDEX theme_previews_expires_at ON theme_previews(expires_at);
+
+PRAGMA optimize;
diff --git a/backend/src/auth.rs b/backend/src/auth.rs
new file mode 100644
index 0000000..5b14083
--- /dev/null
+++ b/backend/src/auth.rs
@@ -0,0 +1,75 @@
+use argon2::{
+    password_hash::{rand_core::OsRng, PasswordHash, PasswordHasher, PasswordVerifier, SaltString},
+    Argon2,
+};
+use pbkdf2::pbkdf2_hmac;
+use rand::RngCore;
+use sha2::{Digest, Sha256};
+
+pub const CLIENT_PASSWORD_ROUNDS: u32 = 600_000;
+
+pub fn hash_password(password_derived: &str) -> anyhow::Result<String> {
+    let salt = SaltString::generate(&mut OsRng);
+    Ok(Argon2::default()
+        .hash_password(password_derived.as_bytes(), &salt)
+        .map_err(|error| anyhow::anyhow!(error.to_string()))?
+        .to_string())
+}
+
+pub fn verify_password(password_derived: &str, hash: &str) -> bool {
+    PasswordHash::new(hash).ok().is_some_and(|parsed| {
+        Argon2::default()
+            .verify_password(password_derived.as_bytes(), &parsed)
+            .is_ok()
+    })
+}
+
+pub fn derive_client_password(password: &str, deployment_salt: &str) -> String {
+    let mut digest = [0_u8; 32];
+    pbkdf2_hmac::<Sha256>(
+        password.as_bytes(),
+        format!("nodeflare:{deployment_salt}").as_bytes(),
+        CLIENT_PASSWORD_ROUNDS,
+        &mut digest,
+    );
+    hex::encode(digest)
+}
+
+pub fn random_token(bytes: usize) -> String {
+    let mut value = vec![0_u8; bytes];
+    rand::rngs::OsRng.fill_bytes(&mut value);
+    hex::encode(value)
+}
+
+pub fn token_hash(token: &str) -> String {
+    hex::encode(Sha256::digest(token.as_bytes()))
+}
+
+pub fn valid_password_derived(value: &str) -> bool {
+    value.len() == 64 && value.bytes().all(|byte| byte.is_ascii_hexdigit())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn hashes_and_verifies_derived_passwords() {
+        let derived = derive_client_password("correct horse battery staple", "deployment-salt");
+        let hash = hash_password(&derived).unwrap();
+        assert!(verify_password(&derived, &hash));
+        assert!(!verify_password(
+            &derive_client_password("wrong", "deployment-salt"),
+            &hash
+        ));
+    }
+
+    #[test]
+    fn creates_random_tokens() {
+        let left = random_token(32);
+        let right = random_token(32);
+        assert_eq!(left.len(), 64);
+        assert_ne!(left, right);
+        assert_eq!(token_hash(&left).len(), 64);
+    }
+}
diff --git a/backend/src/config.rs b/backend/src/config.rs
new file mode 100644
index 0000000..08f285f
--- /dev/null
+++ b/backend/src/config.rs
@@ -0,0 +1,180 @@
+use anyhow::{Context, Result};
+use clap::Parser;
+use serde::Deserialize;
+use std::net::SocketAddr;
+use std::path::{Path, PathBuf};
+
+pub const VERSION: &str = match option_env!("NODEFLARE_VERSION") {
+    Some(version) => version,
+    None => env!("CARGO_PKG_VERSION"),
+};
+
+#[derive(Debug, Parser)]
+#[command(version = VERSION, about = "NodeFlare standalone monitoring server")]
+pub struct Args {
+    /// Path to the TOML configuration file.
+    #[arg(short, long, default_value = "backend/config.toml")]
+    pub config: PathBuf,
+
+    /// Override the configured bind address.
+    #[arg(long)]
+    pub bind: Option<SocketAddr>,
+
+    /// Override the configured SQLite or PostgreSQL URL.
+    #[arg(long)]
+    pub database: Option<String>,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct Config {
+    #[serde(default = "default_database_url")]
+    pub database_url: String,
+    #[serde(default = "default_bind_addr")]
+    pub bind_addr: String,
+    pub admin_username: String,
+    pub admin_password: String,
+    #[serde(default)]
+    pub turnstile_site_key: String,
+    #[serde(default)]
+    pub turnstile_secret_key: String,
+    #[serde(default = "default_public_frontend_dir")]
+    pub frontend_dir: PathBuf,
+    #[serde(default = "default_admin_frontend_dir")]
+    pub admin_frontend_dir: PathBuf,
+    #[serde(default = "default_agent_dir")]
+    pub agent_dir: PathBuf,
+    #[serde(default = "default_session_hours")]
+    pub session_ttl_hours: i64,
+}
+
+fn default_database_url() -> String {
+    "sqlite://nodeflare.db".to_string()
+}
+
+fn default_bind_addr() -> String {
+    "0.0.0.0:8080".to_string()
+}
+
+fn default_public_frontend_dir() -> PathBuf {
+    PathBuf::from("../frontend/dist")
+}
+
+fn default_admin_frontend_dir() -> PathBuf {
+    PathBuf::from("../frontend/admin-dist")
+}
+
+fn default_agent_dir() -> PathBuf {
+    PathBuf::from("../agent")
+}
+
+fn default_session_hours() -> i64 {
+    7 * 24
+}
+
+impl Config {
+    pub fn load(path: &Path) -> Result<Self> {
+        let content = std::fs::read_to_string(path)
+            .with_context(|| format!("failed to read configuration {}", path.display()))?;
+        let mut config: Config = toml::from_str(&content)
+            .with_context(|| format!("failed to parse configuration {}", path.display()))?;
+        let base = path
+            .parent()
+            .filter(|parent| !parent.as_os_str().is_empty())
+            .unwrap_or_else(|| Path::new("."));
+        config.frontend_dir = resolve_path(base, &config.frontend_dir);
+        config.admin_frontend_dir = resolve_path(base, &config.admin_frontend_dir);
+        config.agent_dir = resolve_path(base, &config.agent_dir);
+        config.database_url = resolve_database_url(base, &config.database_url)?;
+        config.session_ttl_hours = config.session_ttl_hours.clamp(1, 24 * 90);
+        if config.admin_username.trim().is_empty()
+            || config.admin_username.chars().any(char::is_whitespace)
+            || config.admin_username.chars().count() > 64
+        {
+            anyhow::bail!("admin_username must be 1-64 characters without whitespace");
+        }
+        if !(8..=128).contains(&config.admin_password.chars().count()) {
+            anyhow::bail!("admin_password must be 8-128 characters");
+        }
+        if is_example_password(&config.admin_password) {
+            anyhow::bail!("admin_password still contains the example placeholder; replace it before starting NodeFlare");
+        }
+        Ok(config)
+    }
+}
+
+fn is_example_password(value: &str) -> bool {
+    matches!(
+        value.trim().to_ascii_lowercase().as_str(),
+        "change_me_with_a_strong_password" | "change-me-with-a-strong-password"
+    )
+}
+
+fn resolve_path(base: &Path, value: &Path) -> PathBuf {
+    if value.is_absolute() {
+        value.to_path_buf()
+    } else {
+        base.join(value)
+    }
+}
+
+fn resolve_database_url(base: &Path, value: &str) -> Result<String> {
+    let value = value.trim();
+    if value.starts_with("postgres://") || value.starts_with("postgresql://") {
+        return Ok(value.to_string());
+    }
+    if value == "sqlite::memory:" {
+        return Ok(value.to_string());
+    }
+    if value.starts_with("sqlite:///") {
+        return Ok(if value.contains('?') {
+            value.to_string()
+        } else {
+            format!("{value}?mode=rwc")
+        });
+    }
+    let Some(relative) = value.strip_prefix("sqlite://") else {
+        anyhow::bail!("database_url must use sqlite://, postgres://, or postgresql://");
+    };
+    let (path, query) = relative.split_once('?').unwrap_or((relative, ""));
+    if path.is_empty() {
+        anyhow::bail!("SQLite database path is empty");
+    }
+    let resolved = resolve_path(base, Path::new(path));
+    let resolved = resolved
+        .to_str()
+        .context("SQLite database path is not valid UTF-8")?;
+    Ok(if query.is_empty() {
+        format!("sqlite://{resolved}?mode=rwc")
+    } else {
+        format!("sqlite://{resolved}?{query}")
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{is_example_password, resolve_database_url};
+    use std::path::Path;
+
+    #[test]
+    fn resolves_database_relative_to_config() {
+        assert_eq!(
+            resolve_database_url(Path::new("/srv/nodeflare/backend"), "sqlite://nodeflare.db")
+                .unwrap(),
+            "sqlite:///srv/nodeflare/backend/nodeflare.db?mode=rwc"
+        );
+    }
+
+    #[test]
+    fn accepts_postgres_urls() {
+        assert_eq!(
+            resolve_database_url(Path::new("."), "postgres://localhost/nodeflare").unwrap(),
+            "postgres://localhost/nodeflare"
+        );
+    }
+
+    #[test]
+    fn detects_example_password_placeholders() {
+        assert!(is_example_password("CHANGE_ME_WITH_A_STRONG_PASSWORD"));
+        assert!(!is_example_password("a-real-password-123"));
+    }
+}
diff --git a/backend/src/db/mod.rs b/backend/src/db/mod.rs
new file mode 100644
index 0000000..85d6447
--- /dev/null
+++ b/backend/src/db/mod.rs
@@ -0,0 +1,582 @@
+pub mod queries;
+
+use crate::auth;
+use crate::config::Config;
+use crate::models::{PublicConfig, SettingsInput, SettingsView};
+use anyhow::Result;
+use sqlx::any::{install_default_drivers, AnyPoolOptions};
+use sqlx::migrate::Migrator;
+use sqlx::{AnyPool, Row};
+use std::collections::HashMap;
+use std::sync::{Mutex, OnceLock};
+
+pub const SECRET_MASK: &str = "********";
+const PASSWORD_SCHEME: &str = "argon2-client-pbkdf2-v1";
+
+static SQLITE_MIGRATOR: Migrator = sqlx::migrate!("./migrations/sqlite");
+static POSTGRES_MIGRATOR: Migrator = sqlx::migrate!("./migrations/postgres");
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum DatabaseKind {
+    Sqlite,
+    Postgres,
+}
+
+#[derive(Clone)]
+pub struct Database {
+    pool: AnyPool,
+    kind: DatabaseKind,
+}
+
+impl Database {
+    pub fn pool(&self) -> &AnyPool {
+        &self.pool
+    }
+
+    pub fn kind(&self) -> DatabaseKind {
+        self.kind
+    }
+
+    pub fn is_postgres(&self) -> bool {
+        self.kind == DatabaseKind::Postgres
+    }
+
+    pub fn sql(&self, statement: &'static str) -> &'static str {
+        if self.kind == DatabaseKind::Sqlite {
+            return statement;
+        }
+        static TRANSLATED: OnceLock<Mutex<HashMap<&'static str, &'static str>>> = OnceLock::new();
+        let translated = TRANSLATED.get_or_init(|| Mutex::new(HashMap::new()));
+        let mut translated = translated.lock().expect("SQL translation lock poisoned");
+        if let Some(value) = translated.get(statement) {
+            return value;
+        }
+        let mut index = 0;
+        let mut output = String::with_capacity(statement.len() + 16);
+        for character in statement.chars() {
+            if character == '?' {
+                index += 1;
+                output.push('$');
+                output.push_str(&index.to_string());
+            } else {
+                output.push(character);
+            }
+        }
+        let output = Box::leak(output.into_boxed_str());
+        translated.insert(statement, output);
+        output
+    }
+
+    pub async fn migrate(&self) -> Result<()> {
+        match self.kind {
+            DatabaseKind::Sqlite => SQLITE_MIGRATOR.run(&self.pool).await?,
+            DatabaseKind::Postgres => POSTGRES_MIGRATOR.run(&self.pool).await?,
+        }
+        Ok(())
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct Settings {
+    pub site_name: String,
+    pub site_description: String,
+    pub site_announcement: String,
+    pub logo_url: String,
+    pub locale: String,
+    pub public_dashboard: bool,
+    pub offline_threshold_seconds: i64,
+    pub history_retention_days: i64,
+    pub default_theme: String,
+    pub active_theme_id: String,
+    pub background_url: String,
+    pub theme_options: serde_json::Value,
+    pub show_search: bool,
+    pub show_groups: bool,
+    pub show_stats: bool,
+    pub show_assets: bool,
+    pub show_traffic: bool,
+    pub show_speed: bool,
+    pub show_price: bool,
+    pub show_expiry: bool,
+    pub show_latency: bool,
+    pub show_uptime: bool,
+    pub admin_username: String,
+    pub admin_password_hash: String,
+    pub password_client_salt: String,
+    pub turnstile_enabled: bool,
+    pub turnstile_login_enabled: bool,
+    pub turnstile_site_key: String,
+    pub turnstile_secret_key: String,
+    pub notification_enabled: bool,
+    pub offline_alert_minutes: i64,
+    pub expiry_alert_days: i64,
+    pub traffic_alert_percentage: i64,
+}
+
+impl Settings {
+    pub fn public_config(&self) -> PublicConfig {
+        let turnstile_configured = !self.turnstile_site_key.trim().is_empty()
+            && !self.turnstile_secret_key.trim().is_empty();
+        PublicConfig {
+            site_name: self.site_name.clone(),
+            site_description: self.site_description.clone(),
+            site_announcement: self.site_announcement.clone(),
+            logo_url: self.logo_url.clone(),
+            locale: self.locale.clone(),
+            public_dashboard: self.public_dashboard,
+            offline_threshold_seconds: self.offline_threshold_seconds,
+            history_retention_days: self.history_retention_days,
+            default_theme: self.default_theme.clone(),
+            active_theme_id: self.active_theme_id.clone(),
+            background_url: self.background_url.clone(),
+            theme_options: self.theme_options.clone(),
+            show_search: self.show_search,
+            show_groups: self.show_groups,
+            show_stats: self.show_stats,
+            show_assets: self.show_assets,
+            show_traffic: self.show_traffic,
+            show_speed: self.show_speed,
+            show_price: self.show_price,
+            show_expiry: self.show_expiry,
+            show_latency: self.show_latency,
+            show_uptime: self.show_uptime,
+            turnstile_enabled: self.turnstile_enabled && turnstile_configured,
+            turnstile_login_enabled: (self.turnstile_login_enabled || self.turnstile_enabled)
+                && turnstile_configured,
+            turnstile_site_key: if turnstile_configured {
+                self.turnstile_site_key.clone()
+            } else {
+                String::new()
+            },
+            password_client_salt: self.password_client_salt.clone(),
+        }
+    }
+
+    pub fn admin_view(&self) -> SettingsView {
+        let mut public = self.public_config();
+        public.turnstile_enabled = self.turnstile_enabled;
+        public.turnstile_login_enabled = self.turnstile_login_enabled;
+        public.turnstile_site_key = mask_secret(&self.turnstile_site_key);
+        public.password_client_salt.clear();
+        SettingsView {
+            public,
+            admin_username: self.admin_username.clone(),
+            admin_password_configured: !self.admin_password_hash.is_empty(),
+            turnstile_secret_key: mask_secret(&self.turnstile_secret_key),
+            notification_enabled: self.notification_enabled,
+            offline_alert_minutes: self.offline_alert_minutes,
+            expiry_alert_days: self.expiry_alert_days,
+            traffic_alert_percentage: self.traffic_alert_percentage,
+        }
+    }
+}
+
+pub async fn connect(database_url: &str) -> Result<Database> {
+    install_default_drivers();
+    let kind = if database_url.starts_with("sqlite:") {
+        DatabaseKind::Sqlite
+    } else if database_url.starts_with("postgres:") || database_url.starts_with("postgresql:") {
+        DatabaseKind::Postgres
+    } else {
+        anyhow::bail!("unsupported database URL");
+    };
+    let pool = AnyPoolOptions::new()
+        .max_connections(if kind == DatabaseKind::Sqlite { 1 } else { 10 })
+        .connect(database_url)
+        .await?;
+    if kind == DatabaseKind::Sqlite {
+        sqlx::query("PRAGMA foreign_keys = ON")
+            .execute(&pool)
+            .await?;
+        sqlx::query("PRAGMA journal_mode = WAL")
+            .execute(&pool)
+            .await?;
+        sqlx::query("PRAGMA busy_timeout = 10000")
+            .execute(&pool)
+            .await?;
+    }
+    Ok(Database { pool, kind })
+}
+
+pub async fn initialize(pool: &Database, config: &Config) -> Result<()> {
+    let now = now();
+    let salt = get_setting(pool, "password_client_salt")
+        .await?
+        .filter(|value| !value.is_empty())
+        .unwrap_or_else(|| auth::random_token(16));
+
+    let defaults = [
+        ("site_name", "NodeFlare".to_string()),
+        ("site_description", "轻量、实时的服务器运行状态".to_string()),
+        ("site_announcement", String::new()),
+        ("logo_url", String::new()),
+        ("locale", "zh-CN".to_string()),
+        ("public_dashboard", "true".to_string()),
+        ("offline_threshold_seconds", "180".to_string()),
+        ("history_retention_days", "30".to_string()),
+        ("default_theme", "system".to_string()),
+        ("active_theme_id", "builtin-nodeflare-glass".to_string()),
+        ("background_url", String::new()),
+        ("theme_options", "{}".to_string()),
+        ("show_search", "true".to_string()),
+        ("show_groups", "true".to_string()),
+        ("show_stats", "true".to_string()),
+        ("show_assets", "true".to_string()),
+        ("show_traffic", "true".to_string()),
+        ("show_speed", "true".to_string()),
+        ("show_price", "true".to_string()),
+        ("show_expiry", "true".to_string()),
+        ("show_latency", "true".to_string()),
+        ("show_uptime", "true".to_string()),
+        ("admin_username", config.admin_username.trim().to_string()),
+        ("password_client_salt", salt.clone()),
+        ("turnstile_enabled", "false".to_string()),
+        ("turnstile_login_enabled", "true".to_string()),
+        (
+            "turnstile_site_key",
+            config.turnstile_site_key.trim().to_string(),
+        ),
+        (
+            "turnstile_secret_key",
+            config.turnstile_secret_key.trim().to_string(),
+        ),
+        ("notification_enabled", "false".to_string()),
+        ("offline_alert_minutes", "5".to_string()),
+        ("expiry_alert_days", "7".to_string()),
+        ("traffic_alert_percentage", "80".to_string()),
+        ("history_cache_version", "0".to_string()),
+    ];
+
+    let mut transaction = pool.pool().begin().await?;
+    for (key, value) in defaults {
+        sqlx::query(
+            pool.sql("INSERT INTO settings(key, value) VALUES (?, ?) ON CONFLICT(key) DO NOTHING"),
+        )
+        .bind(key)
+        .bind(value)
+        .execute(&mut *transaction)
+        .await?;
+    }
+
+    let scheme =
+        sqlx::query_scalar::<_, String>(pool.sql("SELECT value FROM settings WHERE key = ?"))
+            .bind("password_scheme")
+            .fetch_optional(&mut *transaction)
+            .await?;
+    if scheme.as_deref() != Some(PASSWORD_SCHEME) {
+        let derived = auth::derive_client_password(&config.admin_password, &salt);
+        let password_hash = auth::hash_password(&derived)?;
+        for (key, value) in [
+            ("admin_username", config.admin_username.trim()),
+            ("admin_password_hash", password_hash.as_str()),
+            ("password_client_salt", salt.as_str()),
+            ("password_scheme", PASSWORD_SCHEME),
+        ] {
+            sqlx::query(pool.sql(
+                "INSERT INTO settings(key, value) VALUES (?, ?) \
+                 ON CONFLICT(key) DO UPDATE SET value=excluded.value",
+            ))
+            .bind(key)
+            .bind(value)
+            .execute(&mut *transaction)
+            .await?;
+        }
+        sqlx::query("DELETE FROM sessions")
+            .execute(&mut *transaction)
+            .await?;
+        sqlx::query("DELETE FROM settings WHERE key LIKE 'session_%'")
+            .execute(&mut *transaction)
+            .await?;
+        tracing::info!(timestamp = now, "initialized standalone password scheme");
+    }
+    transaction.commit().await?;
+    Ok(())
+}
+
+pub async fn load_settings(pool: &Database) -> Result<Settings> {
+    let rows = sqlx::query("SELECT key, value FROM settings")
+        .fetch_all(pool.pool())
+        .await?;
+    let values = rows
+        .into_iter()
+        .map(|row| (row.get::<String, _>("key"), row.get::<String, _>("value")))
+        .collect::<HashMap<_, _>>();
+    Ok(Settings {
+        site_name: string(&values, "site_name", "NodeFlare"),
+        site_description: string(&values, "site_description", "轻量、实时的服务器运行状态"),
+        site_announcement: string(&values, "site_announcement", ""),
+        logo_url: string(&values, "logo_url", ""),
+        locale: string(&values, "locale", "zh-CN"),
+        public_dashboard: boolean(&values, "public_dashboard", true),
+        offline_threshold_seconds: integer(&values, "offline_threshold_seconds", 180)
+            .clamp(30, 3600),
+        history_retention_days: integer(&values, "history_retention_days", 30).clamp(1, 3650),
+        default_theme: string(&values, "default_theme", "system"),
+        active_theme_id: string(&values, "active_theme_id", "builtin-nodeflare-glass"),
+        background_url: string(&values, "background_url", ""),
+        theme_options: values
+            .get("theme_options")
+            .and_then(|value| serde_json::from_str(value).ok())
+            .filter(serde_json::Value::is_object)
+            .unwrap_or_else(|| serde_json::json!({})),
+        show_search: boolean(&values, "show_search", true),
+        show_groups: boolean(&values, "show_groups", true),
+        show_stats: boolean(&values, "show_stats", true),
+        show_assets: boolean(&values, "show_assets", true),
+        show_traffic: boolean(&values, "show_traffic", true),
+        show_speed: boolean(&values, "show_speed", true),
+        show_price: boolean(&values, "show_price", true),
+        show_expiry: boolean(&values, "show_expiry", true),
+        show_latency: boolean(&values, "show_latency", true),
+        show_uptime: boolean(&values, "show_uptime", true),
+        admin_username: string(&values, "admin_username", "admin"),
+        admin_password_hash: string(&values, "admin_password_hash", ""),
+        password_client_salt: string(&values, "password_client_salt", ""),
+        turnstile_enabled: boolean(&values, "turnstile_enabled", false),
+        turnstile_login_enabled: boolean(&values, "turnstile_login_enabled", true),
+        turnstile_site_key: string(&values, "turnstile_site_key", ""),
+        turnstile_secret_key: string(&values, "turnstile_secret_key", ""),
+        notification_enabled: boolean(&values, "notification_enabled", false),
+        offline_alert_minutes: integer(&values, "offline_alert_minutes", 5).clamp(2, 1440),
+        expiry_alert_days: integer(&values, "expiry_alert_days", 7).clamp(0, 365),
+        traffic_alert_percentage: integer(&values, "traffic_alert_percentage", 80).clamp(50, 100),
+    })
+}
+
+pub async fn update_settings(
+    pool: &Database,
+    input: &SettingsInput,
+    password_hash: Option<&str>,
+) -> Result<()> {
+    let mut updates = Vec::<(&str, String)>::new();
+    macro_rules! text {
+        ($field:ident, $key:literal) => {
+            if let Some(value) = input.$field.as_deref() {
+                updates.push(($key, value.trim().to_string()));
+            }
+        };
+    }
+    macro_rules! boolean {
+        ($field:ident, $key:literal) => {
+            if let Some(value) = input.$field {
+                updates.push(($key, value.to_string()));
+            }
+        };
+    }
+    text!(site_name, "site_name");
+    text!(site_description, "site_description");
+    text!(site_announcement, "site_announcement");
+    text!(logo_url, "logo_url");
+    text!(locale, "locale");
+    boolean!(public_dashboard, "public_dashboard");
+    if let Some(value) = input.offline_threshold_seconds {
+        updates.push((
+            "offline_threshold_seconds",
+            value.clamp(30, 3600).to_string(),
+        ));
+    }
+    if let Some(value) = input.history_retention_days {
+        updates.push(("history_retention_days", value.clamp(1, 3650).to_string()));
+    }
+    text!(default_theme, "default_theme");
+    text!(active_theme_id, "active_theme_id");
+    text!(background_url, "background_url");
+    if let Some(value) = input.theme_options.as_ref() {
+        updates.push(("theme_options", value.to_string()));
+    }
+    boolean!(show_search, "show_search");
+    boolean!(show_groups, "show_groups");
+    boolean!(show_stats, "show_stats");
+    boolean!(show_assets, "show_assets");
+    boolean!(show_traffic, "show_traffic");
+    boolean!(show_speed, "show_speed");
+    boolean!(show_price, "show_price");
+    boolean!(show_expiry, "show_expiry");
+    boolean!(show_latency, "show_latency");
+    boolean!(show_uptime, "show_uptime");
+    text!(admin_username, "admin_username");
+    if let Some(value) = password_hash {
+        updates.push(("admin_password_hash", value.to_string()));
+        updates.push(("password_scheme", PASSWORD_SCHEME.to_string()));
+    }
+    boolean!(turnstile_enabled, "turnstile_enabled");
+    boolean!(turnstile_login_enabled, "turnstile_login_enabled");
+    if let Some(value) = input
+        .turnstile_site_key
+        .as_deref()
+        .filter(|value| value.trim() != SECRET_MASK)
+    {
+        updates.push(("turnstile_site_key", value.trim().to_string()));
+    }
+    if let Some(value) = input
+        .turnstile_secret_key
+        .as_deref()
+        .filter(|value| value.trim() != SECRET_MASK)
+    {
+        updates.push(("turnstile_secret_key", value.trim().to_string()));
+    }
+    boolean!(notification_enabled, "notification_enabled");
+    if let Some(value) = input.offline_alert_minutes {
+        updates.push(("offline_alert_minutes", value.clamp(2, 1440).to_string()));
+    }
+    if let Some(value) = input.expiry_alert_days {
+        updates.push(("expiry_alert_days", value.clamp(0, 365).to_string()));
+    }
+    if let Some(value) = input.traffic_alert_percentage {
+        updates.push(("traffic_alert_percentage", value.clamp(50, 100).to_string()));
+    }
+
+    let mut transaction = pool.pool().begin().await?;
+    for (key, value) in updates {
+        sqlx::query(pool.sql(
+            "INSERT INTO settings(key, value) VALUES (?, ?) \
+             ON CONFLICT(key) DO UPDATE SET value=excluded.value",
+        ))
+        .bind(key)
+        .bind(value)
+        .execute(&mut *transaction)
+        .await?;
+    }
+    if password_hash.is_some() || input.admin_username.is_some() {
+        sqlx::query("DELETE FROM sessions")
+            .execute(&mut *transaction)
+            .await?;
+    }
+    transaction.commit().await?;
+    Ok(())
+}
+
+pub async fn get_setting(pool: &Database, key: &str) -> Result<Option<String>> {
+    Ok(
+        sqlx::query_scalar::<_, String>(pool.sql("SELECT value FROM settings WHERE key = ?"))
+            .bind(key)
+            .fetch_optional(pool.pool())
+            .await?,
+    )
+}
+
+pub async fn set_setting(pool: &Database, key: &str, value: &str) -> Result<()> {
+    sqlx::query(pool.sql(
+        "INSERT INTO settings(key, value) VALUES (?, ?) \
+         ON CONFLICT(key) DO UPDATE SET value=excluded.value",
+    ))
+    .bind(key)
+    .bind(value)
+    .execute(pool.pool())
+    .await?;
+    Ok(())
+}
+
+pub async fn create_session(pool: &Database, username: &str, ttl_hours: i64) -> Result<String> {
+    let token = auth::random_token(32);
+    let created_at = now();
+    let expires_at = created_at.saturating_add(ttl_hours.clamp(1, 24 * 90) * 3600);
+    sqlx::query(pool.sql(
+        "INSERT INTO sessions(token_hash, username, created_at, expires_at) VALUES (?, ?, ?, ?)",
+    ))
+    .bind(auth::token_hash(&token))
+    .bind(username)
+    .bind(created_at)
+    .bind(expires_at)
+    .execute(pool.pool())
+    .await?;
+    Ok(token)
+}
+
+pub async fn session_username(pool: &Database, token: &str) -> Result<Option<String>> {
+    if token.is_empty() || token.len() > 512 {
+        return Ok(None);
+    }
+    let current = now();
+    Ok(sqlx::query_scalar::<_, String>(
+        pool.sql("SELECT username FROM sessions WHERE token_hash = ? AND expires_at > ?"),
+    )
+    .bind(auth::token_hash(token))
+    .bind(current)
+    .fetch_optional(pool.pool())
+    .await?)
+}
+
+pub async fn revoke_session(pool: &Database, token: &str) -> Result<()> {
+    sqlx::query(pool.sql("DELETE FROM sessions WHERE token_hash = ?"))
+        .bind(auth::token_hash(token))
+        .execute(pool.pool())
+        .await?;
+    Ok(())
+}
+
+pub async fn create_dashboard_proof(pool: &Database) -> Result<String> {
+    let token = auth::random_token(32);
+    let created_at = now();
+    sqlx::query(
+        pool.sql(
+            "INSERT INTO dashboard_proofs(token_hash, created_at, expires_at) VALUES (?, ?, ?)",
+        ),
+    )
+    .bind(auth::token_hash(&token))
+    .bind(created_at)
+    .bind(created_at + 3600)
+    .execute(pool.pool())
+    .await?;
+    Ok(token)
+}
+
+pub async fn valid_dashboard_proof(pool: &Database, token: &str) -> Result<bool> {
+    if token.is_empty() || token.len() > 512 {
+        return Ok(false);
+    }
+    let count = sqlx::query_scalar::<_, i64>(
+        pool.sql("SELECT COUNT(*) FROM dashboard_proofs WHERE token_hash = ? AND expires_at > ?"),
+    )
+    .bind(auth::token_hash(token))
+    .bind(now())
+    .fetch_one(pool.pool())
+    .await?;
+    Ok(count > 0)
+}
+
+pub async fn cleanup_auth(pool: &Database) -> Result<()> {
+    let current = now();
+    sqlx::query(pool.sql("DELETE FROM sessions WHERE expires_at <= ?"))
+        .bind(current)
+        .execute(pool.pool())
+        .await?;
+    sqlx::query(pool.sql("DELETE FROM dashboard_proofs WHERE expires_at <= ?"))
+        .bind(current)
+        .execute(pool.pool())
+        .await?;
+    Ok(())
+}
+
+pub fn now() -> i64 {
+    time::OffsetDateTime::now_utc().unix_timestamp()
+}
+
+fn string(values: &HashMap<String, String>, key: &str, fallback: &str) -> String {
+    values
+        .get(key)
+        .cloned()
+        .unwrap_or_else(|| fallback.to_string())
+}
+
+fn integer(values: &HashMap<String, String>, key: &str, fallback: i64) -> i64 {
+    values
+        .get(key)
+        .and_then(|value| value.parse().ok())
+        .unwrap_or(fallback)
+}
+
+fn boolean(values: &HashMap<String, String>, key: &str, fallback: bool) -> bool {
+    values
+        .get(key)
+        .and_then(|value| value.parse().ok())
+        .unwrap_or(fallback)
+}
+
+fn mask_secret(value: &str) -> String {
+    if value.is_empty() {
+        String::new()
+    } else {
+        SECRET_MASK.to_string()
+    }
+}
diff --git a/backend/src/db/queries.rs b/backend/src/db/queries.rs
new file mode 100644
index 0000000..ce115f8
--- /dev/null
+++ b/backend/src/db/queries.rs
@@ -0,0 +1,1785 @@
+use super::{now, Database, SECRET_MASK};
+use crate::auth;
+use crate::models::{
+    AgentLatencyResult, AgentLatencyTask, AgentReport, AlertRuleInput, AlertRuleView,
+    DatabaseStats, HistoryPoint, LatencySample, LatencyTaskInput, LatencyTaskView, RemoteTaskInfo,
+    ServerInput, ServerView, TelegramSettingsInput, TelegramSettingsView, ThemeInput, ThemeView,
+};
+use anyhow::{Context, Result};
+use sqlx::{Any, Row, Transaction};
+use std::collections::{HashMap, HashSet};
+
+#[derive(Debug, Clone)]
+pub struct AgentIdentity {
+    pub server_id: String,
+    pub hidden: bool,
+    pub report_interval: i64,
+    pub collect_interval: i64,
+    pub reset_day: i64,
+    pub rx_correction: i64,
+    pub tx_correction: i64,
+}
+
+#[derive(Debug, Clone)]
+pub struct PersistResult {
+    pub reports: Vec<AgentReport>,
+    pub persisted_through: i64,
+}
+
+#[derive(Debug, Clone, Default)]
+struct TrafficState {
+    cycle_key: i64,
+    reset_day: i64,
+    timestamp: i64,
+    raw_rx: i64,
+    raw_tx: i64,
+    used_rx: i64,
+    used_tx: i64,
+}
+
+pub async fn list_servers(db: &Database, include_hidden: bool) -> Result<Vec<ServerView>> {
+    let statement = if include_hidden {
+        "SELECT s.id, s.name, s.region, s.group_name, s.tags, s.hidden, s.expires_at, \
+         s.traffic_limit, s.traffic_limit_type, s.price, s.billing_cycle, s.currency, \
+         s.auto_renewal, s.last_ip, s.ip_v4, s.ip_v6, s.network_interface, s.reset_day, \
+         s.report_interval, s.collect_interval, s.rx_correction, s.tx_correction, \
+         s.agent_mirror, s.offline_notify_disabled, s.auto_update, \
+         l.latest_timestamp, l.latest_json, l.cpu AS legacy_cpu, l.mem_used AS legacy_mem_used, \
+         l.mem_total AS legacy_mem_total, l.disk_used AS legacy_disk_used, \
+         l.disk_total AS legacy_disk_total, l.net_in AS legacy_net_in, \
+         l.net_out AS legacy_net_out, l.uptime AS legacy_uptime \
+         FROM servers s LEFT JOIN server_latest_state l ON l.server_id=s.id \
+         ORDER BY s.sort_order, s.created_at"
+    } else {
+        "SELECT s.id, s.name, s.region, s.group_name, s.tags, s.hidden, s.expires_at, \
+         s.traffic_limit, s.traffic_limit_type, s.price, s.billing_cycle, s.currency, \
+         s.auto_renewal, s.last_ip, s.ip_v4, s.ip_v6, s.network_interface, s.reset_day, \
+         s.report_interval, s.collect_interval, s.rx_correction, s.tx_correction, \
+         s.agent_mirror, s.offline_notify_disabled, s.auto_update, \
+         l.latest_timestamp, l.latest_json, l.cpu AS legacy_cpu, l.mem_used AS legacy_mem_used, \
+         l.mem_total AS legacy_mem_total, l.disk_used AS legacy_disk_used, \
+         l.disk_total AS legacy_disk_total, l.net_in AS legacy_net_in, \
+         l.net_out AS legacy_net_out, l.uptime AS legacy_uptime \
+         FROM servers s LEFT JOIN server_latest_state l ON l.server_id=s.id \
+         WHERE s.hidden=0 ORDER BY s.sort_order, s.created_at"
+    };
+    let rows = sqlx::query(statement).fetch_all(db.pool()).await?;
+    let latency = latest_latency_map(db).await?;
+    rows.into_iter()
+        .map(|row| {
+            let id: String = row.try_get("id")?;
+            let timestamp: Option<i64> = row.try_get("latest_timestamp")?;
+            let latest_json: Option<String> = row.try_get("latest_json")?;
+            let report = latest_json
+                .as_deref()
+                .filter(|value| !value.is_empty() && *value != "{}")
+                .and_then(|value| serde_json::from_str::<AgentReport>(value).ok());
+            let legacy = timestamp.map(|timestamp| AgentReport {
+                timestamp,
+                cpu: row
+                    .try_get::<Option<f64>, _>("legacy_cpu")
+                    .ok()
+                    .flatten()
+                    .unwrap_or(0.0),
+                mem_used: row
+                    .try_get::<Option<i64>, _>("legacy_mem_used")
+                    .ok()
+                    .flatten()
+                    .unwrap_or(0),
+                mem_total: row
+                    .try_get::<Option<i64>, _>("legacy_mem_total")
+                    .ok()
+                    .flatten()
+                    .unwrap_or(0),
+                disk_used: row
+                    .try_get::<Option<i64>, _>("legacy_disk_used")
+                    .ok()
+                    .flatten()
+                    .unwrap_or(0),
+                disk_total: row
+                    .try_get::<Option<i64>, _>("legacy_disk_total")
+                    .ok()
+                    .flatten()
+                    .unwrap_or(0),
+                net_in: row
+                    .try_get::<Option<f64>, _>("legacy_net_in")
+                    .ok()
+                    .flatten()
+                    .unwrap_or(0.0),
+                net_out: row
+                    .try_get::<Option<f64>, _>("legacy_net_out")
+                    .ok()
+                    .flatten()
+                    .unwrap_or(0.0),
+                uptime: row
+                    .try_get::<Option<i64>, _>("legacy_uptime")
+                    .ok()
+                    .flatten()
+                    .unwrap_or(0),
+                ..AgentReport::default()
+            });
+            let report = report.or(legacy);
+            let value = |read: fn(&AgentReport) -> f64| report.as_ref().map(read);
+            let integer = |read: fn(&AgentReport) -> i64| report.as_ref().map(read);
+            let text = |read: fn(&AgentReport) -> &String| report.as_ref().map(|r| read(r).clone());
+            Ok(ServerView {
+                id: id.clone(),
+                name: row.try_get("name")?,
+                region: row.try_get("region")?,
+                group_name: row.try_get("group_name")?,
+                tags: row.try_get("tags")?,
+                hidden: row.try_get::<i64, _>("hidden")? != 0,
+                expires_at: row.try_get("expires_at")?,
+                traffic_limit: row.try_get("traffic_limit")?,
+                traffic_limit_type: row.try_get("traffic_limit_type")?,
+                price: row.try_get("price")?,
+                billing_cycle: row.try_get("billing_cycle")?,
+                currency: row.try_get("currency")?,
+                auto_renewal: row.try_get::<i64, _>("auto_renewal")? != 0,
+                last_ip: row.try_get("last_ip")?,
+                ip_v4: row.try_get("ip_v4")?,
+                ip_v6: row.try_get("ip_v6")?,
+                network_interface: row.try_get("network_interface")?,
+                reset_day: row.try_get("reset_day")?,
+                report_interval: row.try_get("report_interval")?,
+                collect_interval: row.try_get("collect_interval")?,
+                rx_correction: row.try_get("rx_correction")?,
+                tx_correction: row.try_get("tx_correction")?,
+                agent_mirror: row.try_get("agent_mirror")?,
+                offline_notify_disabled: row.try_get::<i64, _>("offline_notify_disabled")? != 0,
+                auto_update: row.try_get::<i64, _>("auto_update")? != 0,
+                timestamp: report.as_ref().map(|report| report.timestamp).or(timestamp),
+                cpu: value(|r| r.cpu),
+                load1: value(|r| r.load1),
+                load5: value(|r| r.load5),
+                load15: value(|r| r.load15),
+                mem_used: integer(|r| r.mem_used),
+                mem_total: integer(|r| r.mem_total),
+                swap_used: integer(|r| r.swap_used),
+                swap_total: integer(|r| r.swap_total),
+                disk_used: integer(|r| r.disk_used),
+                disk_total: integer(|r| r.disk_total),
+                net_in: value(|r| r.net_in),
+                net_out: value(|r| r.net_out),
+                net_rx_total: integer(|r| r.net_rx_total),
+                net_tx_total: integer(|r| r.net_tx_total),
+                uptime: integer(|r| r.uptime),
+                processes: integer(|r| r.processes),
+                tcp_connections: integer(|r| r.tcp_connections),
+                udp_connections: integer(|r| r.udp_connections),
+                cpu_cores: integer(|r| r.cpu_cores),
+                cpu_model: text(|r| &r.cpu_model),
+                os: text(|r| &r.os),
+                kernel: text(|r| &r.kernel),
+                arch: text(|r| &r.arch),
+                virtualization: text(|r| &r.virtualization),
+                gpu_usage: value(|r| r.gpu_usage),
+                gpu_model: text(|r| &r.gpu_model),
+                agent_version: text(|r| &r.agent_version),
+                disk_read_bps: value(|r| r.disk_read_bps),
+                disk_write_bps: value(|r| r.disk_write_bps),
+                disk_read_iops: value(|r| r.disk_read_iops),
+                disk_write_iops: value(|r| r.disk_write_iops),
+                disk_await_ms: value(|r| r.disk_await_ms),
+                disk_utilization: value(|r| r.disk_utilization),
+                disks: report.as_ref().map(|r| r.disks.clone()).unwrap_or_default(),
+                gpus: report.as_ref().map(|r| r.gpus.clone()).unwrap_or_default(),
+                latency: latency.get(&id).cloned().unwrap_or_default(),
+            })
+        })
+        .collect::<std::result::Result<Vec<_>, sqlx::Error>>()
+        .map_err(Into::into)
+}
+
+pub async fn all_server_ids(db: &Database) -> Result<HashSet<String>> {
+    let rows = sqlx::query("SELECT id FROM servers")
+        .fetch_all(db.pool())
+        .await?;
+    Ok(rows
+        .into_iter()
+        .filter_map(|row| row.try_get::<String, _>("id").ok())
+        .collect())
+}
+
+pub async fn create_server(db: &Database, input: &ServerInput) -> Result<(String, String)> {
+    let id = uuid::Uuid::new_v4().to_string();
+    let token = auth::random_token(32);
+    let timestamp = now();
+    let mut transaction = db.pool().begin().await?;
+    sqlx::query(db.sql(
+        "INSERT INTO servers( \
+         id, token, name, region, group_name, tags, hidden, expires_at, traffic_limit, \
+         traffic_limit_type, price, billing_cycle, currency, auto_renewal, last_ip, ip_v4, ip_v6, \
+         network_interface, reset_day, report_interval, collect_interval, rx_correction, \
+         tx_correction, agent_mirror, offline_notify_disabled, auto_update, created_at, updated_at, \
+         sort_order) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, '', '', '', ?, ?, ?, ?, ?, \
+         ?, ?, ?, ?, ?, ?, (SELECT COALESCE(MAX(sort_order), -1) + 1 FROM servers))",
+    ))
+    .bind(&id)
+    .bind(&token)
+    .bind(input.name.trim())
+    .bind(input.region.trim())
+    .bind(input.group_name.trim())
+    .bind(input.tags.trim())
+    .bind(i64::from(input.hidden))
+    .bind(input.expires_at)
+    .bind(input.traffic_limit)
+    .bind(&input.traffic_limit_type)
+    .bind(input.price)
+    .bind(input.billing_cycle)
+    .bind(input.currency.to_ascii_uppercase())
+    .bind(i64::from(input.auto_renewal))
+    .bind(input.network_interface.trim())
+    .bind(input.reset_day)
+    .bind(input.report_interval)
+    .bind(input.collect_interval)
+    .bind(input.rx_correction)
+    .bind(input.tx_correction)
+    .bind(input.agent_mirror.trim().trim_end_matches('/'))
+    .bind(i64::from(input.offline_notify_disabled))
+    .bind(i64::from(input.auto_update))
+    .bind(timestamp)
+    .bind(timestamp)
+    .execute(&mut *transaction)
+    .await?;
+    sqlx::query(db.sql(
+        "INSERT INTO latency_task_servers(task_id, server_id, assigned_at) \
+         SELECT id, ?, ? FROM latency_tasks WHERE default_enabled=1 \
+         ON CONFLICT(task_id, server_id) DO NOTHING",
+    ))
+    .bind(&id)
+    .bind(timestamp)
+    .execute(&mut *transaction)
+    .await?;
+    transaction.commit().await?;
+    Ok((id, token))
+}
+
+pub async fn update_server(db: &Database, id: &str, input: &ServerInput) -> Result<bool> {
+    let result = sqlx::query(db.sql(
+        "UPDATE servers SET name=?, region=?, group_name=?, tags=?, hidden=?, expires_at=?, \
+         traffic_limit=?, traffic_limit_type=?, price=?, billing_cycle=?, currency=?, auto_renewal=?, \
+         network_interface=?, reset_day=?, report_interval=?, collect_interval=?, rx_correction=?, \
+         tx_correction=?, agent_mirror=?, offline_notify_disabled=?, auto_update=?, updated_at=? \
+         WHERE id=?",
+    ))
+    .bind(input.name.trim())
+    .bind(input.region.trim())
+    .bind(input.group_name.trim())
+    .bind(input.tags.trim())
+    .bind(i64::from(input.hidden))
+    .bind(input.expires_at)
+    .bind(input.traffic_limit)
+    .bind(&input.traffic_limit_type)
+    .bind(input.price)
+    .bind(input.billing_cycle)
+    .bind(input.currency.to_ascii_uppercase())
+    .bind(i64::from(input.auto_renewal))
+    .bind(input.network_interface.trim())
+    .bind(input.reset_day)
+    .bind(input.report_interval)
+    .bind(input.collect_interval)
+    .bind(input.rx_correction)
+    .bind(input.tx_correction)
+    .bind(input.agent_mirror.trim().trim_end_matches('/'))
+    .bind(i64::from(input.offline_notify_disabled))
+    .bind(i64::from(input.auto_update))
+    .bind(now())
+    .bind(id)
+    .execute(db.pool())
+    .await?;
+    Ok(result.rows_affected() > 0)
+}
+
+pub async fn delete_server(db: &Database, id: &str) -> Result<bool> {
+    let result = sqlx::query(db.sql("DELETE FROM servers WHERE id=?"))
+        .bind(id)
+        .execute(db.pool())
+        .await?;
+    Ok(result.rows_affected() > 0)
+}
+
+pub async fn delete_servers(db: &Database, ids: &[String]) -> Result<()> {
+    let mut transaction = db.pool().begin().await?;
+    for id in ids {
+        sqlx::query(db.sql("DELETE FROM servers WHERE id=?"))
+            .bind(id)
+            .execute(&mut *transaction)
+            .await?;
+    }
+    transaction.commit().await?;
+    Ok(())
+}
+
+pub async fn reorder_servers(db: &Database, ids: &[String]) -> Result<()> {
+    let mut transaction = db.pool().begin().await?;
+    for (index, id) in ids.iter().enumerate() {
+        sqlx::query(db.sql("UPDATE servers SET sort_order=?, updated_at=? WHERE id=?"))
+            .bind(index as i64)
+            .bind(now())
+            .bind(id)
+            .execute(&mut *transaction)
+            .await?;
+    }
+    transaction.commit().await?;
+    Ok(())
+}
+
+pub async fn server_token(db: &Database, id: &str) -> Result<Option<String>> {
+    Ok(
+        sqlx::query_scalar::<_, String>(db.sql("SELECT token FROM servers WHERE id=?"))
+            .bind(id)
+            .fetch_optional(db.pool())
+            .await?,
+    )
+}
+
+pub async fn agent_identity(db: &Database, token: &str) -> Result<Option<AgentIdentity>> {
+    let row = sqlx::query(db.sql(
+        "SELECT id, hidden, report_interval, collect_interval, reset_day, rx_correction, \
+         tx_correction FROM servers WHERE token=?",
+    ))
+    .bind(token)
+    .fetch_optional(db.pool())
+    .await?;
+    row.map(|row| {
+        Ok::<AgentIdentity, sqlx::Error>(AgentIdentity {
+            server_id: row.try_get("id")?,
+            hidden: row.try_get::<i64, _>("hidden")? != 0,
+            report_interval: row.try_get("report_interval")?,
+            collect_interval: row.try_get("collect_interval")?,
+            reset_day: row.try_get("reset_day")?,
+            rx_correction: row.try_get("rx_correction")?,
+            tx_correction: row.try_get("tx_correction")?,
+        })
+    })
+    .transpose()
+    .map_err(Into::into)
+}
+
+pub async fn agent_config(db: &Database, id: &str) -> Result<Option<serde_json::Value>> {
+    let row = sqlx::query(db.sql(
+        "SELECT report_interval, collect_interval, network_interface, agent_mirror, auto_update \
+         FROM servers WHERE id=?",
+    ))
+    .bind(id)
+    .fetch_optional(db.pool())
+    .await?;
+    let Some(row) = row else {
+        return Ok(None);
+    };
+    let tasks = tasks_for_server(db, id).await?;
+    Ok(Some(serde_json::json!({
+        "report_interval": row.try_get::<i64, _>("report_interval")?,
+        "collect_interval": row.try_get::<i64, _>("collect_interval")?,
+        "network_interface": row.try_get::<String, _>("network_interface")?,
+        "agent_mirror": row.try_get::<String, _>("agent_mirror")?,
+        "auto_update": row.try_get::<i64, _>("auto_update")? != 0,
+        "latency_tasks": tasks,
+    })))
+}
+
+pub async fn save_agent_batch(
+    db: &Database,
+    identity: &AgentIdentity,
+    batch_id: &str,
+    reports: &[AgentReport],
+    remote_ip: &str,
+) -> Result<PersistResult> {
+    let mut reports = reports.to_vec();
+    reports.sort_by_key(|report| report.timestamp);
+    reports.dedup_by_key(|report| report.timestamp);
+    let current = now();
+    reports.retain(|report| {
+        report.timestamp > 0
+            && report.timestamp >= current - 7 * 86_400
+            && report.timestamp <= current + 300
+    });
+    if reports.is_empty() {
+        anyhow::bail!("report batch contains no valid samples");
+    }
+    if reports.len() > 720 {
+        anyhow::bail!("report batch exceeds 720 samples");
+    }
+
+    let mut transaction = db.pool().begin().await?;
+    let latest_row = sqlx::query(
+        db.sql("SELECT latest_timestamp, last_batch_id FROM server_latest_state WHERE server_id=?"),
+    )
+    .bind(&identity.server_id)
+    .fetch_optional(&mut *transaction)
+    .await?;
+    let persisted_before = latest_row
+        .as_ref()
+        .and_then(|row| row.try_get::<i64, _>("latest_timestamp").ok())
+        .unwrap_or(0);
+    if latest_row.as_ref().is_some_and(|row| {
+        row.try_get::<String, _>("last_batch_id").ok().as_deref() == Some(batch_id)
+    }) {
+        transaction.rollback().await?;
+        return Ok(PersistResult {
+            reports: Vec::new(),
+            persisted_through: persisted_before,
+        });
+    }
+    reports.retain(|report| report.timestamp > persisted_before);
+    if reports.is_empty() {
+        transaction.rollback().await?;
+        return Ok(PersistResult {
+            reports: Vec::new(),
+            persisted_through: persisted_before,
+        });
+    }
+
+    let mut traffic = load_traffic_state(db, &mut transaction, &identity.server_id).await?;
+    for report in &mut reports {
+        apply_traffic(report, &mut traffic, identity);
+        save_history_row(db, &mut transaction, &identity.server_id, report).await?;
+        save_latency_rows(
+            db,
+            &mut transaction,
+            &identity.server_id,
+            &report.latency_results,
+        )
+        .await?;
+    }
+    let latest = reports.last().context("report batch became empty")?;
+    let persisted_through = latest.timestamp;
+    let latest_json = serde_json::to_string(latest)?;
+    sqlx::query(db.sql(
+        "INSERT INTO server_latest_state(server_id, latest_timestamp, cpu, mem_used, mem_total, \
+         disk_used, disk_total, net_in, net_out, uptime, latest_json, last_batch_id) \
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) \
+         ON CONFLICT(server_id) DO UPDATE SET latest_timestamp=excluded.latest_timestamp, \
+         cpu=excluded.cpu, mem_used=excluded.mem_used, mem_total=excluded.mem_total, \
+         disk_used=excluded.disk_used, disk_total=excluded.disk_total, net_in=excluded.net_in, \
+         net_out=excluded.net_out, uptime=excluded.uptime, latest_json=excluded.latest_json, \
+         last_batch_id=excluded.last_batch_id",
+    ))
+    .bind(&identity.server_id)
+    .bind(latest.timestamp)
+    .bind(latest.cpu)
+    .bind(latest.mem_used)
+    .bind(latest.mem_total)
+    .bind(latest.disk_used)
+    .bind(latest.disk_total)
+    .bind(latest.net_in)
+    .bind(latest.net_out)
+    .bind(latest.uptime)
+    .bind(latest_json)
+    .bind(batch_id)
+    .execute(&mut *transaction)
+    .await?;
+    save_traffic_state(db, &mut transaction, &identity.server_id, &traffic).await?;
+    sqlx::query(db.sql(
+        "UPDATE servers SET last_ip=?, ip_v4=CASE WHEN ?='' THEN ip_v4 ELSE ? END, \
+         ip_v6=CASE WHEN ?='' THEN ip_v6 ELSE ? END, updated_at=? WHERE id=?",
+    ))
+    .bind(remote_ip)
+    .bind(&latest.ip_v4)
+    .bind(&latest.ip_v4)
+    .bind(&latest.ip_v6)
+    .bind(&latest.ip_v6)
+    .bind(current)
+    .bind(&identity.server_id)
+    .execute(&mut *transaction)
+    .await?;
+    transaction.commit().await?;
+    Ok(PersistResult {
+        reports,
+        persisted_through,
+    })
+}
+
+async fn load_traffic_state(
+    db: &Database,
+    transaction: &mut Transaction<'_, Any>,
+    server_id: &str,
+) -> Result<TrafficState> {
+    let row = sqlx::query(db.sql(
+        "SELECT cycle_key, reset_day, timestamp, raw_rx, raw_tx, used_rx, used_tx \
+         FROM server_traffic_state WHERE server_id=?",
+    ))
+    .bind(server_id)
+    .fetch_optional(&mut **transaction)
+    .await?;
+    row.map(|row| {
+        Ok::<TrafficState, sqlx::Error>(TrafficState {
+            cycle_key: row.try_get("cycle_key")?,
+            reset_day: row.try_get("reset_day")?,
+            timestamp: row.try_get("timestamp")?,
+            raw_rx: row.try_get("raw_rx")?,
+            raw_tx: row.try_get("raw_tx")?,
+            used_rx: row.try_get("used_rx")?,
+            used_tx: row.try_get("used_tx")?,
+        })
+    })
+    .transpose()
+    .map(|state| state.unwrap_or_default())
+    .map_err(Into::into)
+}
+
+fn apply_traffic(report: &mut AgentReport, state: &mut TrafficState, identity: &AgentIdentity) {
+    if report.timestamp <= state.timestamp {
+        report.net_rx_total = state.used_rx.saturating_add(identity.rx_correction).max(0);
+        report.net_tx_total = state.used_tx.saturating_add(identity.tx_correction).max(0);
+        return;
+    }
+    let cycle_key = traffic_cycle_key(report.timestamp, identity.reset_day);
+    if state.timestamp == 0 {
+        state.used_rx = report.net_rx_total.max(0);
+        state.used_tx = report.net_tx_total.max(0);
+    } else if state.cycle_key != cycle_key || state.reset_day != identity.reset_day {
+        state.used_rx = 0;
+        state.used_tx = 0;
+    } else {
+        let rx_delta = if report.net_rx_total >= state.raw_rx {
+            report.net_rx_total - state.raw_rx
+        } else {
+            report.net_rx_total
+        };
+        let tx_delta = if report.net_tx_total >= state.raw_tx {
+            report.net_tx_total - state.raw_tx
+        } else {
+            report.net_tx_total
+        };
+        state.used_rx = state.used_rx.saturating_add(rx_delta.max(0));
+        state.used_tx = state.used_tx.saturating_add(tx_delta.max(0));
+    }
+    state.cycle_key = cycle_key;
+    state.reset_day = identity.reset_day;
+    state.timestamp = report.timestamp;
+    state.raw_rx = report.net_rx_total.max(0);
+    state.raw_tx = report.net_tx_total.max(0);
+    report.net_rx_total = state.used_rx.saturating_add(identity.rx_correction).max(0);
+    report.net_tx_total = state.used_tx.saturating_add(identity.tx_correction).max(0);
+}
+
+async fn save_traffic_state(
+    db: &Database,
+    transaction: &mut Transaction<'_, Any>,
+    server_id: &str,
+    state: &TrafficState,
+) -> Result<()> {
+    sqlx::query(db.sql(
+        "INSERT INTO server_traffic_state(server_id, cycle_key, reset_day, timestamp, raw_rx, \
+         raw_tx, used_rx, used_tx) VALUES (?, ?, ?, ?, ?, ?, ?, ?) \
+         ON CONFLICT(server_id) DO UPDATE SET cycle_key=excluded.cycle_key, \
+         reset_day=excluded.reset_day, timestamp=excluded.timestamp, raw_rx=excluded.raw_rx, \
+         raw_tx=excluded.raw_tx, used_rx=excluded.used_rx, used_tx=excluded.used_tx",
+    ))
+    .bind(server_id)
+    .bind(state.cycle_key)
+    .bind(state.reset_day)
+    .bind(state.timestamp)
+    .bind(state.raw_rx)
+    .bind(state.raw_tx)
+    .bind(state.used_rx)
+    .bind(state.used_tx)
+    .execute(&mut **transaction)
+    .await?;
+    Ok(())
+}
+
+async fn save_history_row(
+    db: &Database,
+    transaction: &mut Transaction<'_, Any>,
+    server_id: &str,
+    report: &AgentReport,
+) -> Result<()> {
+    sqlx::query(db.sql(
+        "INSERT INTO metric_history(server_id, timestamp, cpu, load1, load5, load15, mem_used, \
+         mem_total, swap_used, swap_total, disk_used, disk_total, net_in, net_out, net_rx_total, \
+         net_tx_total, uptime, processes, tcp_connections, udp_connections, gpu_usage, \
+         disk_read_bps, disk_write_bps, disk_read_iops, disk_write_iops, disk_await_ms, \
+         disk_utilization) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, \
+         ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(server_id, timestamp) DO UPDATE SET cpu=excluded.cpu, \
+         load1=excluded.load1, load5=excluded.load5, load15=excluded.load15, \
+         mem_used=excluded.mem_used, mem_total=excluded.mem_total, swap_used=excluded.swap_used, \
+         swap_total=excluded.swap_total, disk_used=excluded.disk_used, disk_total=excluded.disk_total, \
+         net_in=excluded.net_in, net_out=excluded.net_out, net_rx_total=excluded.net_rx_total, \
+         net_tx_total=excluded.net_tx_total, uptime=excluded.uptime, processes=excluded.processes, \
+         tcp_connections=excluded.tcp_connections, udp_connections=excluded.udp_connections, \
+         gpu_usage=excluded.gpu_usage, disk_read_bps=excluded.disk_read_bps, \
+         disk_write_bps=excluded.disk_write_bps, disk_read_iops=excluded.disk_read_iops, \
+         disk_write_iops=excluded.disk_write_iops, disk_await_ms=excluded.disk_await_ms, \
+         disk_utilization=excluded.disk_utilization",
+    ))
+    .bind(server_id)
+    .bind(report.timestamp)
+    .bind(report.cpu)
+    .bind(report.load1)
+    .bind(report.load5)
+    .bind(report.load15)
+    .bind(report.mem_used)
+    .bind(report.mem_total)
+    .bind(report.swap_used)
+    .bind(report.swap_total)
+    .bind(report.disk_used)
+    .bind(report.disk_total)
+    .bind(report.net_in)
+    .bind(report.net_out)
+    .bind(report.net_rx_total)
+    .bind(report.net_tx_total)
+    .bind(report.uptime)
+    .bind(report.processes)
+    .bind(report.tcp_connections)
+    .bind(report.udp_connections)
+    .bind(report.gpu_usage)
+    .bind(report.disk_read_bps)
+    .bind(report.disk_write_bps)
+    .bind(report.disk_read_iops)
+    .bind(report.disk_write_iops)
+    .bind(report.disk_await_ms)
+    .bind(report.disk_utilization)
+    .execute(&mut **transaction)
+    .await?;
+    Ok(())
+}
+
+async fn save_latency_rows(
+    db: &Database,
+    transaction: &mut Transaction<'_, Any>,
+    server_id: &str,
+    results: &[AgentLatencyResult],
+) -> Result<()> {
+    for result in results {
+        if result.task_id.is_empty()
+            || result.timestamp <= 0
+            || !result.latency_ms.is_finite()
+            || !result.packet_loss.is_finite()
+        {
+            continue;
+        }
+        sqlx::query(db.sql(
+            "INSERT INTO latency_results(task_id, server_id, timestamp, latency_ms, packet_loss) \
+             SELECT ?, ?, ?, ?, ? WHERE EXISTS (SELECT 1 FROM latency_task_servers \
+             WHERE task_id=? AND server_id=?) ON CONFLICT(task_id, server_id, timestamp) \
+             DO UPDATE SET latency_ms=excluded.latency_ms, packet_loss=excluded.packet_loss",
+        ))
+        .bind(&result.task_id)
+        .bind(server_id)
+        .bind(result.timestamp)
+        .bind(result.latency_ms)
+        .bind(result.packet_loss)
+        .bind(&result.task_id)
+        .bind(server_id)
+        .execute(&mut **transaction)
+        .await?;
+    }
+    Ok(())
+}
+
+pub async fn history(db: &Database, server_id: &str, hours: i64) -> Result<Vec<HistoryPoint>> {
+    let hours = hours.clamp(1, 24 * 365);
+    let bucket = (hours * 3600 / 720).max(1);
+    let since = now() - hours * 3600;
+    let rows = sqlx::query(db.sql(
+        "SELECT bucket_timestamp, AVG(cpu) AS cpu, AVG(load1) AS load1, \
+         AVG(load5) AS load5, AVG(load15) AS load15, \
+         AVG(CAST(mem_used AS DOUBLE PRECISION)) AS mem_used, \
+         MAX(mem_total) AS mem_total, \
+         AVG(CAST(swap_used AS DOUBLE PRECISION)) AS swap_used, \
+         MAX(swap_total) AS swap_total, \
+         MAX(disk_used) AS disk_used, MAX(disk_total) AS disk_total, MAX(net_in) AS net_in, \
+         MAX(net_out) AS net_out, MAX(net_rx_total) AS net_rx_total, \
+         MAX(net_tx_total) AS net_tx_total, MAX(processes) AS processes, \
+         MAX(tcp_connections) AS tcp_connections, MAX(udp_connections) AS udp_connections, \
+         AVG(gpu_usage) AS gpu_usage, MAX(disk_read_bps) AS disk_read_bps, \
+         MAX(disk_write_bps) AS disk_write_bps, MAX(disk_read_iops) AS disk_read_iops, \
+         MAX(disk_write_iops) AS disk_write_iops, MAX(disk_await_ms) AS disk_await_ms, \
+         MAX(disk_utilization) AS disk_utilization FROM ( \
+           SELECT (timestamp / ?) * ? AS bucket_timestamp, metric_history.* \
+           FROM metric_history WHERE server_id=? AND timestamp>=? \
+         ) samples GROUP BY bucket_timestamp ORDER BY bucket_timestamp",
+    ))
+    .bind(bucket)
+    .bind(bucket)
+    .bind(server_id)
+    .bind(since)
+    .fetch_all(db.pool())
+    .await?;
+    rows.into_iter()
+        .map(|row| {
+            Ok(HistoryPoint {
+                timestamp: row.try_get("bucket_timestamp")?,
+                cpu: row.try_get::<f64, _>("cpu")?,
+                load1: row.try_get::<f64, _>("load1")?,
+                load5: row.try_get::<f64, _>("load5")?,
+                load15: row.try_get::<f64, _>("load15")?,
+                mem_used: row.try_get::<f64, _>("mem_used")?.round() as i64,
+                mem_total: row.try_get("mem_total")?,
+                swap_used: row.try_get::<f64, _>("swap_used")?.round() as i64,
+                swap_total: row.try_get("swap_total")?,
+                disk_used: row.try_get("disk_used")?,
+                disk_total: row.try_get("disk_total")?,
+                net_in: row.try_get("net_in")?,
+                net_out: row.try_get("net_out")?,
+                net_rx_total: row.try_get("net_rx_total")?,
+                net_tx_total: row.try_get("net_tx_total")?,
+                processes: row.try_get("processes")?,
+                tcp_connections: row.try_get("tcp_connections")?,
+                udp_connections: row.try_get("udp_connections")?,
+                gpu_usage: row.try_get("gpu_usage")?,
+                disk_read_bps: row.try_get("disk_read_bps")?,
+                disk_write_bps: row.try_get("disk_write_bps")?,
+                disk_read_iops: row.try_get("disk_read_iops")?,
+                disk_write_iops: row.try_get("disk_write_iops")?,
+                disk_await_ms: row.try_get("disk_await_ms")?,
+                disk_utilization: row.try_get("disk_utilization")?,
+            })
+        })
+        .collect::<std::result::Result<Vec<_>, sqlx::Error>>()
+        .map_err(Into::into)
+}
+
+pub async fn clear_history(db: &Database) -> Result<()> {
+    let mut transaction = db.pool().begin().await?;
+    sqlx::query("DELETE FROM metric_history")
+        .execute(&mut *transaction)
+        .await?;
+    sqlx::query("DELETE FROM latency_results")
+        .execute(&mut *transaction)
+        .await?;
+    transaction.commit().await?;
+    Ok(())
+}
+
+pub async fn cleanup_history(db: &Database, retention_days: i64) -> Result<()> {
+    let cutoff = now() - retention_days.clamp(1, 3650) * 86_400;
+    sqlx::query(db.sql("DELETE FROM metric_history WHERE timestamp<?"))
+        .bind(cutoff)
+        .execute(db.pool())
+        .await?;
+    sqlx::query(db.sql("DELETE FROM latency_results WHERE timestamp<?"))
+        .bind(cutoff)
+        .execute(db.pool())
+        .await?;
+    Ok(())
+}
+
+pub async fn database_stats(db: &Database, offline_threshold: i64) -> Result<DatabaseStats> {
+    let cutoff = now() - offline_threshold.clamp(30, 3600);
+    let row = sqlx::query(db.sql(
+        "SELECT (SELECT COUNT(*) FROM servers) AS server_count, \
+         (SELECT COUNT(*) FROM server_latest_state WHERE latest_timestamp>=?) AS online_count, \
+         ((SELECT COUNT(*) FROM metric_history) + (SELECT COUNT(*) FROM latency_results)) \
+         AS history_rows",
+    ))
+    .bind(cutoff)
+    .fetch_one(db.pool())
+    .await?;
+    Ok(DatabaseStats {
+        server_count: row.try_get("server_count")?,
+        online_count: row.try_get("online_count")?,
+        history_rows: row.try_get("history_rows")?,
+    })
+}
+
+pub async fn public_server_exists(db: &Database, server_id: &str) -> Result<bool> {
+    let count = sqlx::query_scalar::<_, i64>(
+        db.sql("SELECT COUNT(*) FROM servers WHERE id=? AND hidden=0"),
+    )
+    .bind(server_id)
+    .fetch_one(db.pool())
+    .await?;
+    Ok(count > 0)
+}
+
+fn traffic_cycle_key(timestamp: i64, reset_day: i64) -> i64 {
+    let Ok(datetime) = time::OffsetDateTime::from_unix_timestamp(timestamp) else {
+        return 0;
+    };
+    let date = datetime.date();
+    let year = i64::from(date.year());
+    let month = date.month() as i64;
+    let day = i64::from(date.day());
+    let boundary = reset_day.clamp(1, 31).min(days_in_month(year, month));
+    let current_month = year * 12 + month - 1;
+    if day >= boundary {
+        current_month
+    } else {
+        current_month - 1
+    }
+}
+
+fn days_in_month(year: i64, month: i64) -> i64 {
+    match month {
+        2 if year % 4 == 0 && (year % 100 != 0 || year % 400 == 0) => 29,
+        2 => 28,
+        4 | 6 | 9 | 11 => 30,
+        _ => 31,
+    }
+}
+
+async fn latest_latency_map(db: &Database) -> Result<HashMap<String, Vec<LatencySample>>> {
+    let rows = sqlx::query(
+        "SELECT a.server_id, t.id AS task_id, t.name, t.task_type, t.target, t.port, \
+         lr.timestamp, lr.latency_ms, lr.packet_loss FROM latency_task_servers a \
+         JOIN latency_tasks t ON t.id=a.task_id LEFT JOIN latency_results lr \
+         ON lr.task_id=a.task_id AND lr.server_id=a.server_id AND lr.timestamp=( \
+           SELECT MAX(newer.timestamp) FROM latency_results newer \
+           WHERE newer.task_id=a.task_id AND newer.server_id=a.server_id \
+             AND newer.timestamp>=a.assigned_at) \
+         ORDER BY t.sort_order, t.created_at",
+    )
+    .fetch_all(db.pool())
+    .await?;
+    let mut result = HashMap::<String, Vec<LatencySample>>::new();
+    for row in rows {
+        let server_id: String = row.try_get("server_id")?;
+        result
+            .entry(server_id.clone())
+            .or_default()
+            .push(LatencySample {
+                task_id: row.try_get("task_id")?,
+                server_id,
+                name: row.try_get("name")?,
+                task_type: row.try_get("task_type")?,
+                target: row.try_get("target")?,
+                port: row.try_get("port")?,
+                timestamp: row
+                    .try_get::<Option<i64>, _>("timestamp")?
+                    .unwrap_or_default(),
+                latency_ms: row.try_get::<Option<f64>, _>("latency_ms")?.unwrap_or(-1.0),
+                packet_loss: row
+                    .try_get::<Option<f64>, _>("packet_loss")?
+                    .unwrap_or(-1.0),
+            });
+    }
+    Ok(result)
+}
+
+pub async fn list_latency_tasks(db: &Database) -> Result<Vec<LatencyTaskView>> {
+    let rows = sqlx::query(
+        "SELECT id, name, task_type, target, port, interval_seconds, default_enabled \
+         FROM latency_tasks ORDER BY sort_order, created_at",
+    )
+    .fetch_all(db.pool())
+    .await?;
+    let assignments = sqlx::query(
+        "SELECT task_id, server_id FROM latency_task_servers ORDER BY task_id, server_id",
+    )
+    .fetch_all(db.pool())
+    .await?;
+    let mut by_task = HashMap::<String, Vec<String>>::new();
+    for row in assignments {
+        by_task
+            .entry(row.try_get("task_id")?)
+            .or_default()
+            .push(row.try_get("server_id")?);
+    }
+    rows.into_iter()
+        .map(|row| {
+            let id: String = row.try_get("id")?;
+            Ok(LatencyTaskView {
+                server_ids: by_task.remove(&id).unwrap_or_default(),
+                id,
+                name: row.try_get("name")?,
+                task_type: row.try_get("task_type")?,
+                target: row.try_get("target")?,
+                port: row.try_get("port")?,
+                interval_seconds: row.try_get("interval_seconds")?,
+                default_enabled: row.try_get::<i64, _>("default_enabled")? != 0,
+            })
+        })
+        .collect::<std::result::Result<Vec<_>, sqlx::Error>>()
+        .map_err(Into::into)
+}
+
+pub async fn tasks_for_server(db: &Database, server_id: &str) -> Result<Vec<AgentLatencyTask>> {
+    let rows = sqlx::query(db.sql(
+        "SELECT t.id, t.name, t.task_type, t.target, t.port, t.interval_seconds \
+         FROM latency_tasks t JOIN latency_task_servers a ON a.task_id=t.id \
+         WHERE a.server_id=? ORDER BY t.sort_order, t.created_at",
+    ))
+    .bind(server_id)
+    .fetch_all(db.pool())
+    .await?;
+    rows.into_iter()
+        .map(|row| {
+            Ok(AgentLatencyTask {
+                id: row.try_get("id")?,
+                name: row.try_get("name")?,
+                task_type: row.try_get("task_type")?,
+                target: row.try_get("target")?,
+                port: row.try_get("port")?,
+                interval_seconds: row.try_get("interval_seconds")?,
+            })
+        })
+        .collect::<std::result::Result<Vec<_>, sqlx::Error>>()
+        .map_err(Into::into)
+}
+
+pub async fn create_latency_task(db: &Database, input: &LatencyTaskInput) -> Result<String> {
+    let id = uuid::Uuid::new_v4().to_string();
+    let timestamp = now();
+    let mut transaction = db.pool().begin().await?;
+    sqlx::query(db.sql(
+        "INSERT INTO latency_tasks(id, name, task_type, target, port, interval_seconds, \
+         default_enabled, sort_order, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, \
+         (SELECT COALESCE(MAX(sort_order), -1) + 1 FROM latency_tasks), ?, ?)",
+    ))
+    .bind(&id)
+    .bind(input.name.trim())
+    .bind(&input.task_type)
+    .bind(input.target.trim())
+    .bind(input.port)
+    .bind(input.interval_seconds)
+    .bind(i64::from(input.default_enabled))
+    .bind(timestamp)
+    .bind(timestamp)
+    .execute(&mut *transaction)
+    .await?;
+    replace_task_servers(db, &mut transaction, &id, &input.server_ids, timestamp).await?;
+    transaction.commit().await?;
+    Ok(id)
+}
+
+pub async fn update_latency_task(
+    db: &Database,
+    id: &str,
+    input: &LatencyTaskInput,
+) -> Result<bool> {
+    let timestamp = now();
+    let mut transaction = db.pool().begin().await?;
+    let result = sqlx::query(db.sql(
+        "UPDATE latency_tasks SET name=?, task_type=?, target=?, port=?, interval_seconds=?, \
+         default_enabled=?, updated_at=? WHERE id=?",
+    ))
+    .bind(input.name.trim())
+    .bind(&input.task_type)
+    .bind(input.target.trim())
+    .bind(input.port)
+    .bind(input.interval_seconds)
+    .bind(i64::from(input.default_enabled))
+    .bind(timestamp)
+    .bind(id)
+    .execute(&mut *transaction)
+    .await?;
+    if result.rows_affected() == 0 {
+        transaction.rollback().await?;
+        return Ok(false);
+    }
+    replace_task_servers(db, &mut transaction, id, &input.server_ids, timestamp).await?;
+    transaction.commit().await?;
+    Ok(true)
+}
+
+async fn replace_task_servers(
+    db: &Database,
+    transaction: &mut Transaction<'_, Any>,
+    task_id: &str,
+    server_ids: &[String],
+    timestamp: i64,
+) -> Result<()> {
+    sqlx::query(db.sql("DELETE FROM latency_task_servers WHERE task_id=?"))
+        .bind(task_id)
+        .execute(&mut **transaction)
+        .await?;
+    for server_id in server_ids {
+        sqlx::query(db.sql(
+            "INSERT INTO latency_task_servers(task_id, server_id, assigned_at) VALUES (?, ?, ?)",
+        ))
+        .bind(task_id)
+        .bind(server_id)
+        .bind(timestamp)
+        .execute(&mut **transaction)
+        .await?;
+    }
+    Ok(())
+}
+
+pub async fn delete_latency_task(db: &Database, id: &str) -> Result<bool> {
+    let result = sqlx::query(db.sql("DELETE FROM latency_tasks WHERE id=?"))
+        .bind(id)
+        .execute(db.pool())
+        .await?;
+    Ok(result.rows_affected() > 0)
+}
+
+pub async fn latency_task_server_ids(db: &Database, id: &str) -> Result<Vec<String>> {
+    let rows = sqlx::query(db.sql("SELECT server_id FROM latency_task_servers WHERE task_id=?"))
+        .bind(id)
+        .fetch_all(db.pool())
+        .await?;
+    rows.into_iter()
+        .map(|row| row.try_get("server_id"))
+        .collect::<std::result::Result<Vec<_>, _>>()
+        .map_err(Into::into)
+}
+
+pub async fn latency_history(
+    db: &Database,
+    server_id: &str,
+    hours: i64,
+) -> Result<(Vec<AgentLatencyTask>, Vec<LatencySample>)> {
+    let tasks = tasks_for_server(db, server_id).await?;
+    if tasks.is_empty() {
+        return Ok((tasks, Vec::new()));
+    }
+    let bucket = latency_history_bucket_seconds(hours, tasks.len() as i64);
+    let since = now() - hours.clamp(1, 24 * 365) * 3600;
+    let rows = sqlx::query(db.sql(
+        "SELECT task_id, server_id, name, task_type, target, port, \
+         bucket_timestamp AS timestamp, \
+         CASE WHEN SUM(CASE WHEN latency_ms>=0 THEN 1 ELSE 0 END)>0 \
+           THEN SUM(CASE WHEN latency_ms>=0 THEN latency_ms ELSE 0 END) / \
+                SUM(CASE WHEN latency_ms>=0 THEN CAST(1 AS DOUBLE PRECISION) \
+                         ELSE CAST(0 AS DOUBLE PRECISION) END) ELSE -1 END AS latency_ms, \
+         AVG(packet_loss) AS packet_loss FROM ( \
+           SELECT r.task_id, r.server_id, t.name, t.task_type, t.target, t.port, \
+                  (r.timestamp / ?) * ? AS bucket_timestamp, r.latency_ms, r.packet_loss \
+           FROM latency_results r JOIN latency_tasks t ON t.id=r.task_id \
+           JOIN latency_task_servers a ON a.task_id=r.task_id AND a.server_id=r.server_id \
+           WHERE r.server_id=? AND r.timestamp>=? AND r.timestamp>=a.assigned_at \
+         ) samples GROUP BY task_id, server_id, name, task_type, target, port, bucket_timestamp \
+         ORDER BY bucket_timestamp, name LIMIT 4000",
+    ))
+    .bind(bucket)
+    .bind(bucket)
+    .bind(server_id)
+    .bind(since)
+    .fetch_all(db.pool())
+    .await?;
+    let points = rows
+        .into_iter()
+        .map(|row| {
+            Ok(LatencySample {
+                task_id: row.try_get("task_id")?,
+                server_id: row.try_get("server_id")?,
+                name: row.try_get("name")?,
+                task_type: row.try_get("task_type")?,
+                target: row.try_get("target")?,
+                port: row.try_get("port")?,
+                timestamp: row.try_get("timestamp")?,
+                latency_ms: row.try_get("latency_ms")?,
+                packet_loss: row.try_get("packet_loss")?,
+            })
+        })
+        .collect::<std::result::Result<Vec<_>, sqlx::Error>>()?;
+    Ok((tasks, points))
+}
+
+fn latency_history_bucket_seconds(hours: i64, task_count: i64) -> i64 {
+    let hours = hours.clamp(1, 24 * 365);
+    let task_count = task_count.clamp(1, 128);
+    let base = match hours {
+        1 => 60,
+        2..=4 => 120,
+        5..=24 => 600,
+        25..=168 => 3600,
+        169..=720 => 14_400,
+        _ => 86_400,
+    };
+    let points_per_task = (4000 / task_count).max(1);
+    let bounded = (hours * 3600 + points_per_task - 1) / points_per_task;
+    base.max(bounded)
+}
+
+pub async fn list_alert_rules(db: &Database) -> Result<Vec<AlertRuleView>> {
+    let rows = sqlx::query(
+        "SELECT id, name, metric, threshold, duration_minutes, aggregation, enabled \
+         FROM alert_rules ORDER BY created_at",
+    )
+    .fetch_all(db.pool())
+    .await?;
+    let assignments = sqlx::query("SELECT rule_id, server_id FROM alert_rule_servers")
+        .fetch_all(db.pool())
+        .await?;
+    let mut by_rule = HashMap::<String, Vec<String>>::new();
+    for row in assignments {
+        by_rule
+            .entry(row.try_get("rule_id")?)
+            .or_default()
+            .push(row.try_get("server_id")?);
+    }
+    rows.into_iter()
+        .map(|row| {
+            let id: String = row.try_get("id")?;
+            Ok(AlertRuleView {
+                server_ids: by_rule.remove(&id).unwrap_or_default(),
+                id,
+                name: row.try_get("name")?,
+                metric: row.try_get("metric")?,
+                threshold: row.try_get("threshold")?,
+                duration_minutes: row.try_get("duration_minutes")?,
+                aggregation: row.try_get("aggregation")?,
+                enabled: row.try_get::<i64, _>("enabled")? != 0,
+            })
+        })
+        .collect::<std::result::Result<Vec<_>, sqlx::Error>>()
+        .map_err(Into::into)
+}
+
+pub async fn create_alert_rule(db: &Database, input: &AlertRuleInput) -> Result<String> {
+    let id = uuid::Uuid::new_v4().to_string();
+    let timestamp = now();
+    let mut transaction = db.pool().begin().await?;
+    sqlx::query(db.sql(
+        "INSERT INTO alert_rules(id, name, metric, threshold, duration_minutes, aggregation, \
+         enabled, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
+    ))
+    .bind(&id)
+    .bind(input.name.trim())
+    .bind(&input.metric)
+    .bind(input.threshold)
+    .bind(input.duration_minutes)
+    .bind(&input.aggregation)
+    .bind(i64::from(input.enabled))
+    .bind(timestamp)
+    .bind(timestamp)
+    .execute(&mut *transaction)
+    .await?;
+    replace_alert_servers(db, &mut transaction, &id, &input.server_ids).await?;
+    transaction.commit().await?;
+    Ok(id)
+}
+
+pub async fn update_alert_rule(db: &Database, id: &str, input: &AlertRuleInput) -> Result<bool> {
+    let mut transaction = db.pool().begin().await?;
+    let result = sqlx::query(db.sql(
+        "UPDATE alert_rules SET name=?, metric=?, threshold=?, duration_minutes=?, aggregation=?, \
+         enabled=?, updated_at=? WHERE id=?",
+    ))
+    .bind(input.name.trim())
+    .bind(&input.metric)
+    .bind(input.threshold)
+    .bind(input.duration_minutes)
+    .bind(&input.aggregation)
+    .bind(i64::from(input.enabled))
+    .bind(now())
+    .bind(id)
+    .execute(&mut *transaction)
+    .await?;
+    if result.rows_affected() == 0 {
+        transaction.rollback().await?;
+        return Ok(false);
+    }
+    replace_alert_servers(db, &mut transaction, id, &input.server_ids).await?;
+    transaction.commit().await?;
+    Ok(true)
+}
+
+async fn replace_alert_servers(
+    db: &Database,
+    transaction: &mut Transaction<'_, Any>,
+    rule_id: &str,
+    server_ids: &[String],
+) -> Result<()> {
+    sqlx::query(db.sql("DELETE FROM alert_rule_servers WHERE rule_id=?"))
+        .bind(rule_id)
+        .execute(&mut **transaction)
+        .await?;
+    for server_id in server_ids {
+        sqlx::query(db.sql("INSERT INTO alert_rule_servers(rule_id, server_id) VALUES (?, ?)"))
+            .bind(rule_id)
+            .bind(server_id)
+            .execute(&mut **transaction)
+            .await?;
+    }
+    Ok(())
+}
+
+pub async fn delete_alert_rule(db: &Database, id: &str) -> Result<bool> {
+    let result = sqlx::query(db.sql("DELETE FROM alert_rules WHERE id=?"))
+        .bind(id)
+        .execute(db.pool())
+        .await?;
+    sqlx::query(db.sql("DELETE FROM alert_states WHERE state_key LIKE ?"))
+        .bind(format!("resource:{id}:%"))
+        .execute(db.pool())
+        .await?;
+    Ok(result.rows_affected() > 0)
+}
+
+#[derive(Debug, Clone)]
+pub struct ResourceAlertEvaluation {
+    pub rule: AlertRuleView,
+    pub value: f64,
+    pub triggered: bool,
+}
+
+pub async fn evaluate_resource_rules(
+    db: &Database,
+    server_id: &str,
+) -> Result<Vec<ResourceAlertEvaluation>> {
+    let rules = list_alert_rules(db).await?;
+    let mut evaluations = Vec::new();
+    for rule in rules.into_iter().filter(|rule| {
+        rule.enabled
+            && (rule.server_ids.is_empty() || rule.server_ids.iter().any(|id| id == server_id))
+    }) {
+        let expression = match rule.metric.as_str() {
+            "cpu" => "cpu",
+            "memory" => {
+                "CASE WHEN mem_total>0 THEN CAST(mem_used AS DOUBLE PRECISION) * \
+                 CAST(100 AS DOUBLE PRECISION) / CAST(mem_total AS DOUBLE PRECISION) \
+                 ELSE CAST(0 AS DOUBLE PRECISION) END"
+            }
+            "disk" => {
+                "CASE WHEN disk_total>0 THEN CAST(disk_used AS DOUBLE PRECISION) * \
+                 CAST(100 AS DOUBLE PRECISION) / CAST(disk_total AS DOUBLE PRECISION) \
+                 ELSE CAST(0 AS DOUBLE PRECISION) END"
+            }
+            "net_in" => "net_in / CAST(1048576 AS DOUBLE PRECISION)",
+            "net_out" => "net_out / CAST(1048576 AS DOUBLE PRECISION)",
+            _ => continue,
+        };
+        let query = if db.is_postgres() {
+            format!(
+                "SELECT MIN(timestamp) AS first_timestamp, AVG({expression}) AS average_value, \
+                 MIN({expression}) AS minimum_value, COUNT(*) AS sample_count \
+                 FROM metric_history WHERE server_id=$1 AND timestamp>=$2"
+            )
+        } else {
+            format!(
+                "SELECT MIN(timestamp) AS first_timestamp, AVG({expression}) AS average_value, \
+                 MIN({expression}) AS minimum_value, COUNT(*) AS sample_count \
+                 FROM metric_history WHERE server_id=? AND timestamp>=?"
+            )
+        };
+        let since = now() - rule.duration_minutes * 60;
+        // `expression` and the placeholder syntax above are selected only from
+        // fixed literals; no request data is interpolated into this SQL.
+        let row = sqlx::query(sqlx::AssertSqlSafe(query.as_str()))
+            .bind(server_id)
+            .bind(since)
+            .fetch_one(db.pool())
+            .await?;
+        let first: Option<i64> = row.try_get("first_timestamp")?;
+        let count: i64 = row.try_get("sample_count")?;
+        let average: Option<f64> = row.try_get("average_value")?;
+        let minimum: Option<f64> = row.try_get("minimum_value")?;
+        let value = if rule.aggregation == "continuous" {
+            minimum.unwrap_or_default()
+        } else {
+            average.unwrap_or_default()
+        };
+        let covered = count > 0 && first.is_some_and(|first| first <= since + 5);
+        evaluations.push(ResourceAlertEvaluation {
+            triggered: covered && value >= rule.threshold,
+            rule,
+            value,
+        });
+    }
+    Ok(evaluations)
+}
+
+pub async fn update_alert_state(
+    db: &Database,
+    key: &str,
+    active: bool,
+    details: &serde_json::Value,
+) -> Result<bool> {
+    let previous =
+        sqlx::query_scalar::<_, i64>(db.sql("SELECT active FROM alert_states WHERE state_key=?"))
+            .bind(key)
+            .fetch_optional(db.pool())
+            .await?
+            .unwrap_or(0)
+            != 0;
+    sqlx::query(db.sql(
+        "INSERT INTO alert_states(state_key, active, updated_at, details_json) VALUES (?, ?, ?, ?) \
+         ON CONFLICT(state_key) DO UPDATE SET active=excluded.active, updated_at=excluded.updated_at, \
+         details_json=excluded.details_json",
+    ))
+    .bind(key)
+    .bind(i64::from(active))
+    .bind(now())
+    .bind(details.to_string())
+    .execute(db.pool())
+    .await?;
+    Ok(previous != active)
+}
+
+pub async fn get_totp_secret(db: &Database, username: &str) -> Result<Option<(String, bool)>> {
+    let row = sqlx::query(db.sql("SELECT totp_secret, enabled FROM admin_2fa WHERE username=?"))
+        .bind(username)
+        .fetch_optional(db.pool())
+        .await?;
+    row.map(|row| {
+        Ok::<(String, bool), sqlx::Error>((
+            row.try_get("totp_secret")?,
+            row.try_get::<i64, _>("enabled")? != 0,
+        ))
+    })
+    .transpose()
+    .map_err(Into::into)
+}
+
+pub async fn save_totp_secret(
+    db: &Database,
+    username: &str,
+    secret: &str,
+    enabled: bool,
+) -> Result<()> {
+    sqlx::query(db.sql(
+        "INSERT INTO admin_2fa(username, totp_secret, enabled, created_at) VALUES (?, ?, ?, ?) \
+         ON CONFLICT(username) DO UPDATE SET totp_secret=excluded.totp_secret, \
+         enabled=excluded.enabled",
+    ))
+    .bind(username)
+    .bind(secret)
+    .bind(i64::from(enabled))
+    .bind(now())
+    .execute(db.pool())
+    .await?;
+    Ok(())
+}
+
+pub async fn set_totp_enabled(db: &Database, username: &str, enabled: bool) -> Result<bool> {
+    let result = sqlx::query(db.sql("UPDATE admin_2fa SET enabled=? WHERE username=?"))
+        .bind(i64::from(enabled))
+        .bind(username)
+        .execute(db.pool())
+        .await?;
+    Ok(result.rows_affected() > 0)
+}
+
+pub async fn rename_totp_user(db: &Database, old: &str, new: &str) -> Result<()> {
+    if old == new {
+        return Ok(());
+    }
+    sqlx::query(db.sql("UPDATE admin_2fa SET username=? WHERE username=?"))
+        .bind(new)
+        .bind(old)
+        .execute(db.pool())
+        .await?;
+    Ok(())
+}
+
+pub async fn create_remote_task(
+    db: &Database,
+    server_id: &str,
+    command: &str,
+    script: &str,
+    username: &str,
+) -> Result<RemoteTaskInfo> {
+    let task = RemoteTaskInfo {
+        id: uuid::Uuid::new_v4().to_string(),
+        server_id: server_id.to_string(),
+        command: command.to_string(),
+        script: script.to_string(),
+        status: "pending".to_string(),
+        requested_by: username.to_string(),
+        requested_at: now(),
+        started_at: None,
+        completed_at: None,
+        result: String::new(),
+        exit_code: None,
+    };
+    sqlx::query(db.sql(
+        "INSERT INTO remote_tasks(id, server_id, command, script, status, requested_by, \
+         requested_at) VALUES (?, ?, ?, ?, 'pending', ?, ?)",
+    ))
+    .bind(&task.id)
+    .bind(&task.server_id)
+    .bind(&task.command)
+    .bind(&task.script)
+    .bind(&task.requested_by)
+    .bind(task.requested_at)
+    .execute(db.pool())
+    .await?;
+    Ok(task)
+}
+
+pub async fn remote_task(db: &Database, id: &str) -> Result<Option<RemoteTaskInfo>> {
+    let row = sqlx::query(db.sql(
+        "SELECT id, server_id, command, script, status, requested_by, requested_at, started_at, \
+         completed_at, result, exit_code FROM remote_tasks WHERE id=?",
+    ))
+    .bind(id)
+    .fetch_optional(db.pool())
+    .await?;
+    row.map(remote_task_from_row)
+        .transpose()
+        .map_err(Into::into)
+}
+
+pub async fn server_remote_tasks(
+    db: &Database,
+    server_id: &str,
+    limit: i64,
+) -> Result<Vec<RemoteTaskInfo>> {
+    let rows = sqlx::query(db.sql(
+        "SELECT id, server_id, command, script, status, requested_by, requested_at, started_at, \
+         completed_at, result, exit_code FROM remote_tasks WHERE server_id=? \
+         ORDER BY requested_at DESC LIMIT ?",
+    ))
+    .bind(server_id)
+    .bind(limit.clamp(1, 200))
+    .fetch_all(db.pool())
+    .await?;
+    rows.into_iter()
+        .map(remote_task_from_row)
+        .collect::<std::result::Result<Vec<_>, _>>()
+        .map_err(Into::into)
+}
+
+pub async fn pending_remote_tasks(db: &Database, server_id: &str) -> Result<Vec<RemoteTaskInfo>> {
+    let rows = sqlx::query(db.sql(
+        "SELECT id, server_id, command, script, status, requested_by, requested_at, started_at, \
+         completed_at, result, exit_code FROM remote_tasks WHERE server_id=? AND status='pending' \
+         ORDER BY requested_at LIMIT 50",
+    ))
+    .bind(server_id)
+    .fetch_all(db.pool())
+    .await?;
+    rows.into_iter()
+        .map(remote_task_from_row)
+        .collect::<std::result::Result<Vec<_>, _>>()
+        .map_err(Into::into)
+}
+
+fn remote_task_from_row(
+    row: sqlx::any::AnyRow,
+) -> std::result::Result<RemoteTaskInfo, sqlx::Error> {
+    Ok(RemoteTaskInfo {
+        id: row.try_get("id")?,
+        server_id: row.try_get("server_id")?,
+        command: row.try_get("command")?,
+        script: row.try_get("script")?,
+        status: row.try_get("status")?,
+        requested_by: row.try_get("requested_by")?,
+        requested_at: row.try_get("requested_at")?,
+        started_at: row.try_get("started_at")?,
+        completed_at: row.try_get("completed_at")?,
+        result: row.try_get("result")?,
+        exit_code: row.try_get("exit_code")?,
+    })
+}
+
+pub async fn mark_remote_task_sent(db: &Database, id: &str, server_id: &str) -> Result<()> {
+    sqlx::query(db.sql(
+        "UPDATE remote_tasks SET status='sent', started_at=? \
+         WHERE id=? AND server_id=? AND status='pending'",
+    ))
+    .bind(now())
+    .bind(id)
+    .bind(server_id)
+    .execute(db.pool())
+    .await?;
+    Ok(())
+}
+
+pub async fn update_remote_task_result(
+    db: &Database,
+    server_id: &str,
+    id: &str,
+    status: &str,
+    result: &str,
+    exit_code: Option<i64>,
+) -> Result<bool> {
+    let result = sqlx::query(db.sql(
+        "UPDATE remote_tasks SET status=?, result=?, exit_code=?, completed_at=? \
+         WHERE id=? AND server_id=?",
+    ))
+    .bind(status)
+    .bind(result)
+    .bind(exit_code)
+    .bind(now())
+    .bind(id)
+    .bind(server_id)
+    .execute(db.pool())
+    .await?;
+    Ok(result.rows_affected() > 0)
+}
+
+pub async fn telegram_settings(db: &Database) -> Result<Option<TelegramSettingsView>> {
+    Ok(raw_telegram_settings(db).await?.map(|mut settings| {
+        if !settings.bot_token.is_empty() {
+            settings.bot_token = SECRET_MASK.to_string();
+        }
+        settings
+    }))
+}
+
+pub async fn raw_telegram_settings(db: &Database) -> Result<Option<TelegramSettingsView>> {
+    let row = sqlx::query(
+        "SELECT bot_token, chat_id, message_thread_id, template FROM notification_telegram \
+         WHERE id=1",
+    )
+    .fetch_optional(db.pool())
+    .await?;
+    row.map(|row| {
+        Ok::<TelegramSettingsView, sqlx::Error>(TelegramSettingsView {
+            bot_token: row.try_get("bot_token")?,
+            chat_id: row.try_get("chat_id")?,
+            message_thread_id: row.try_get("message_thread_id")?,
+            template: row.try_get("template")?,
+        })
+    })
+    .transpose()
+    .map_err(Into::into)
+}
+
+pub async fn save_telegram_settings(db: &Database, input: &TelegramSettingsInput) -> Result<()> {
+    let current = raw_telegram_settings(db).await?;
+    let token = if input.bot_token.trim() == SECRET_MASK {
+        current.map(|value| value.bot_token).unwrap_or_default()
+    } else {
+        input.bot_token.trim().to_string()
+    };
+    sqlx::query(db.sql(
+        "INSERT INTO notification_telegram(id, bot_token, chat_id, message_thread_id, template, \
+         updated_at) VALUES (1, ?, ?, ?, ?, ?) ON CONFLICT(id) DO UPDATE SET \
+         bot_token=excluded.bot_token, chat_id=excluded.chat_id, \
+         message_thread_id=excluded.message_thread_id, template=excluded.template, \
+         updated_at=excluded.updated_at",
+    ))
+    .bind(token)
+    .bind(input.chat_id.trim())
+    .bind(input.message_thread_id)
+    .bind(input.template.trim())
+    .bind(now())
+    .execute(db.pool())
+    .await?;
+    Ok(())
+}
+
+pub async fn list_themes(db: &Database, active_id: &str) -> Result<Vec<ThemeView>> {
+    let rows = sqlx::query(
+        "SELECT id, name, description, url, version FROM themes ORDER BY created_at DESC",
+    )
+    .fetch_all(db.pool())
+    .await?;
+    let mut themes = vec![ThemeView {
+        id: "builtin-nodeflare-glass".to_string(),
+        name: "NodeFlare Glass".to_string(),
+        description: "默认主题".to_string(),
+        url: String::new(),
+        version: crate::config::VERSION.to_string(),
+        builtin: true,
+        active: active_id == "builtin-nodeflare-glass",
+    }];
+    for row in rows {
+        let id: String = row.try_get("id")?;
+        themes.push(ThemeView {
+            active: id == active_id,
+            id,
+            name: row.try_get("name")?,
+            description: row.try_get("description")?,
+            url: row.try_get("url")?,
+            version: row.try_get("version")?,
+            builtin: false,
+        });
+    }
+    Ok(themes)
+}
+
+pub async fn create_theme(
+    db: &Database,
+    id: &str,
+    input: &ThemeInput,
+    resolved_url: &str,
+    version: &str,
+) -> Result<()> {
+    sqlx::query(db.sql(
+        "INSERT INTO themes(id, name, description, url, resolved_url, version, created_at) \
+         VALUES (?, ?, ?, ?, ?, ?, ?)",
+    ))
+    .bind(id)
+    .bind(input.name.trim())
+    .bind(input.description.trim())
+    .bind(input.url.trim())
+    .bind(resolved_url)
+    .bind(version)
+    .bind(now())
+    .execute(db.pool())
+    .await?;
+    Ok(())
+}
+
+pub async fn theme_exists(db: &Database, id: &str) -> Result<bool> {
+    let count = sqlx::query_scalar::<_, i64>(db.sql("SELECT COUNT(*) FROM themes WHERE id=?"))
+        .bind(id)
+        .fetch_one(db.pool())
+        .await?;
+    Ok(count > 0)
+}
+
+pub async fn theme_resolved_url(db: &Database, id: &str) -> Result<Option<String>> {
+    Ok(
+        sqlx::query_scalar::<_, String>(db.sql("SELECT resolved_url FROM themes WHERE id=?"))
+            .bind(id)
+            .fetch_optional(db.pool())
+            .await?,
+    )
+}
+
+pub async fn set_active_theme(db: &Database, id: &str) -> Result<bool> {
+    if id != "builtin-nodeflare-glass" && !theme_exists(db, id).await? {
+        return Ok(false);
+    }
+    super::set_setting(db, "active_theme_id", id).await?;
+    Ok(true)
+}
+
+pub async fn delete_theme(db: &Database, id: &str) -> Result<bool> {
+    let result = sqlx::query(db.sql("DELETE FROM themes WHERE id=?"))
+        .bind(id)
+        .execute(db.pool())
+        .await?;
+    if result.rows_affected() > 0
+        && super::get_setting(db, "active_theme_id").await?.as_deref() == Some(id)
+    {
+        super::set_setting(db, "active_theme_id", "builtin-nodeflare-glass").await?;
+    }
+    Ok(result.rows_affected() > 0)
+}
+
+pub async fn create_theme_preview(db: &Database, theme_id: &str) -> Result<String> {
+    let token = auth::random_token(24);
+    sqlx::query(
+        db.sql("INSERT INTO theme_previews(token_hash, theme_id, expires_at) VALUES (?, ?, ?)"),
+    )
+    .bind(auth::token_hash(&token))
+    .bind(theme_id)
+    .bind(now() + 600)
+    .execute(db.pool())
+    .await?;
+    Ok(token)
+}
+
+pub async fn theme_preview_url(db: &Database, token: &str) -> Result<Option<String>> {
+    Ok(sqlx::query_scalar::<_, String>(db.sql(
+        "SELECT t.resolved_url FROM theme_previews p JOIN themes t ON t.id=p.theme_id \
+         WHERE p.token_hash=? AND p.expires_at>?",
+    ))
+    .bind(auth::token_hash(token))
+    .bind(now())
+    .fetch_optional(db.pool())
+    .await?)
+}
+
+pub async fn cleanup_theme_previews(db: &Database) -> Result<()> {
+    sqlx::query(db.sql("DELETE FROM theme_previews WHERE expires_at<=?"))
+        .bind(now())
+        .execute(db.pool())
+        .await?;
+    Ok(())
+}
+
+#[derive(Debug, Clone)]
+pub struct ExchangeSnapshot {
+    pub base_currency: String,
+    pub rates_json: String,
+    pub source: String,
+    pub rate_date: String,
+    pub fetched_at: i64,
+    pub attempted_at: i64,
+}
+
+pub async fn exchange_snapshot(db: &Database, base: &str) -> Result<Option<ExchangeSnapshot>> {
+    let row = sqlx::query(db.sql(
+        "SELECT base_currency, rates_json, source, rate_date, fetched_at, attempted_at \
+         FROM exchange_rates WHERE base_currency=?",
+    ))
+    .bind(base)
+    .fetch_optional(db.pool())
+    .await?;
+    row.map(|row| {
+        Ok::<ExchangeSnapshot, sqlx::Error>(ExchangeSnapshot {
+            base_currency: row.try_get("base_currency")?,
+            rates_json: row.try_get("rates_json")?,
+            source: row.try_get("source")?,
+            rate_date: row.try_get("rate_date")?,
+            fetched_at: row.try_get("fetched_at")?,
+            attempted_at: row.try_get("attempted_at")?,
+        })
+    })
+    .transpose()
+    .map_err(Into::into)
+}
+
+pub async fn mark_exchange_attempt(db: &Database, base: &str, timestamp: i64) -> Result<()> {
+    sqlx::query(db.sql(
+        "INSERT INTO exchange_rates(base_currency, rates_json, source, rate_date, fetched_at, \
+         attempted_at) VALUES (?, '{}', 'default', '', 0, ?) ON CONFLICT(base_currency) \
+         DO UPDATE SET attempted_at=excluded.attempted_at",
+    ))
+    .bind(base)
+    .bind(timestamp)
+    .execute(db.pool())
+    .await?;
+    Ok(())
+}
+
+pub async fn upsert_exchange_snapshot(
+    db: &Database,
+    base: &str,
+    rates_json: &str,
+    source: &str,
+    date: &str,
+    timestamp: i64,
+) -> Result<()> {
+    sqlx::query(db.sql(
+        "INSERT INTO exchange_rates(base_currency, rates_json, source, rate_date, fetched_at, \
+         attempted_at) VALUES (?, ?, ?, ?, ?, ?) ON CONFLICT(base_currency) DO UPDATE SET \
+         rates_json=excluded.rates_json, source=excluded.source, rate_date=excluded.rate_date, \
+         fetched_at=excluded.fetched_at, attempted_at=excluded.attempted_at",
+    ))
+    .bind(base)
+    .bind(rates_json)
+    .bind(source)
+    .bind(date)
+    .bind(timestamp)
+    .bind(timestamp)
+    .execute(db.pool())
+    .await?;
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn server_input(traffic_limit: i64) -> ServerInput {
+        ServerInput {
+            name: "Large traffic node".to_string(),
+            region: "CN".to_string(),
+            group_name: "Test".to_string(),
+            tags: String::new(),
+            hidden: false,
+            expires_at: None,
+            traffic_limit,
+            traffic_limit_type: "sum".to_string(),
+            price: 1.0,
+            billing_cycle: 30,
+            currency: "CNY".to_string(),
+            auto_renewal: false,
+            network_interface: String::new(),
+            reset_day: 1,
+            report_interval: 60,
+            collect_interval: 5,
+            rx_correction: 0,
+            tx_correction: 0,
+            agent_mirror: String::new(),
+            offline_notify_disabled: false,
+            auto_update: true,
+        }
+    }
+
+    #[tokio::test]
+    async fn sqlite_preserves_large_traffic_limits() {
+        let db = super::super::connect("sqlite::memory:").await.unwrap();
+        db.migrate().await.unwrap();
+        let expected = 100_i64 * 1024 * 1024 * 1024;
+        let (id, _) = create_server(&db, &server_input(expected)).await.unwrap();
+        let raw =
+            sqlx::query_scalar::<_, i64>(db.sql("SELECT traffic_limit FROM servers WHERE id=?"))
+                .bind(&id)
+                .fetch_one(db.pool())
+                .await
+                .unwrap();
+        assert_eq!(raw, expected);
+        let server = list_servers(&db, true)
+            .await
+            .unwrap()
+            .into_iter()
+            .find(|server| server.id == id)
+            .unwrap();
+        assert_eq!(server.traffic_limit, expected);
+    }
+}
diff --git a/backend/src/exchange.rs b/backend/src/exchange.rs
new file mode 100644
index 0000000..c81c3b2
--- /dev/null
+++ b/backend/src/exchange.rs
@@ -0,0 +1,232 @@
+use crate::db::{self, queries, Database};
+use crate::models::ExchangeRatesView;
+use anyhow::{Context, Result};
+use serde_json::Value;
+use std::collections::BTreeMap;
+use std::time::Duration;
+
+const BASE: &str = "CNY";
+const PRIMARY_URL: &str = "https://open.er-api.com/v6/latest/CNY";
+const FALLBACK_URL: &str = "https://api.frankfurter.dev/v1/latest?base=CNY";
+const MAX_BODY: usize = 256 * 1024;
+const REFRESH_INTERVAL: i64 = 86_400;
+const RETRY_INTERVAL: i64 = 3_600;
+
+struct FetchedRates {
+    rates: BTreeMap<String, f64>,
+    source: &'static str,
+    date: String,
+}
+
+pub async fn current(db: &Database) -> Result<ExchangeRatesView> {
+    let snapshot = queries::exchange_snapshot(db, BASE).await?;
+    Ok(view(snapshot, db::now()))
+}
+
+pub async fn refresh(
+    db: &Database,
+    client: &reqwest::Client,
+    force: bool,
+) -> Result<ExchangeRatesView> {
+    let current = db::now();
+    let snapshot = queries::exchange_snapshot(db, BASE).await?;
+    let due = force
+        || snapshot.as_ref().is_none_or(|snapshot| {
+            (snapshot.fetched_at <= 0
+                || current.saturating_sub(snapshot.fetched_at) >= REFRESH_INTERVAL)
+                && (snapshot.attempted_at <= 0
+                    || current.saturating_sub(snapshot.attempted_at) >= RETRY_INTERVAL)
+        });
+    if !due {
+        return Ok(view(snapshot, current));
+    }
+    queries::mark_exchange_attempt(db, BASE, current).await?;
+    let fetched = match fetch_json(client, PRIMARY_URL).await {
+        Ok(value) => parse_er_api(&value),
+        Err(error) => {
+            tracing::warn!(%error, "primary exchange-rate request failed");
+            None
+        }
+    };
+    let fetched = match fetched {
+        Some(value) => value,
+        None => parse_frankfurter(&fetch_json(client, FALLBACK_URL).await?)
+            .context("exchange-rate fallback returned invalid data")?,
+    };
+    let mut rates = default_rates();
+    rates.extend(fetched.rates);
+    queries::upsert_exchange_snapshot(
+        db,
+        BASE,
+        &serde_json::to_string(&rates)?,
+        fetched.source,
+        &fetched.date,
+        current,
+    )
+    .await?;
+    current_view(db).await
+}
+
+async fn current_view(db: &Database) -> Result<ExchangeRatesView> {
+    Ok(view(queries::exchange_snapshot(db, BASE).await?, db::now()))
+}
+
+async fn fetch_json(client: &reqwest::Client, url: &str) -> Result<Value> {
+    let response = client
+        .get(url)
+        .header("Accept", "application/json")
+        .header("User-Agent", "NodeFlare-Standalone")
+        .timeout(Duration::from_secs(8))
+        .send()
+        .await?
+        .error_for_status()?;
+    if response
+        .content_length()
+        .is_some_and(|length| length > MAX_BODY as u64)
+    {
+        anyhow::bail!("exchange-rate response is too large");
+    }
+    let body = response.bytes().await?;
+    if body.len() > MAX_BODY {
+        anyhow::bail!("exchange-rate response is too large");
+    }
+    Ok(serde_json::from_slice(&body)?)
+}
+
+fn view(snapshot: Option<queries::ExchangeSnapshot>, current: i64) -> ExchangeRatesView {
+    let snapshot = snapshot.unwrap_or_else(|| queries::ExchangeSnapshot {
+        base_currency: BASE.to_string(),
+        rates_json: serde_json::to_string(&default_rates()).unwrap_or_else(|_| "{}".to_string()),
+        source: "default".to_string(),
+        rate_date: String::new(),
+        fetched_at: 0,
+        attempted_at: 0,
+    });
+    let mut rates = serde_json::from_str::<Value>(&snapshot.rates_json)
+        .ok()
+        .and_then(|value| sanitize_rates(&value))
+        .unwrap_or_else(default_rates);
+    for (currency, rate) in default_rates() {
+        rates.entry(currency).or_insert(rate);
+    }
+    ExchangeRatesView {
+        base: snapshot.base_currency,
+        rates,
+        source: snapshot.source,
+        date: snapshot.rate_date,
+        fetched_at: snapshot.fetched_at,
+        stale: snapshot.fetched_at <= 0
+            || current.saturating_sub(snapshot.fetched_at) >= REFRESH_INTERVAL,
+    }
+}
+
+fn default_rates() -> BTreeMap<String, f64> {
+    [
+        ("CNY", 1.0),
+        ("USD", 0.14799),
+        ("CAD", 0.2086),
+        ("HKD", 1.1594),
+        ("EUR", 0.1275),
+        ("GBP", 0.11027),
+        ("JPY", 23.707),
+        ("RUB", 11.560694),
+        ("CHF", 0.120661),
+        ("INR", 14.248668),
+        ("VND", 3875.968992),
+        ("THB", 4.97107),
+    ]
+    .into_iter()
+    .map(|(currency, rate)| (currency.to_string(), rate))
+    .collect()
+}
+
+fn sanitize_rates(value: &Value) -> Option<BTreeMap<String, f64>> {
+    let object = value.as_object()?;
+    let mut rates = BTreeMap::new();
+    for (currency, value) in object {
+        let currency = currency.trim().to_ascii_uppercase();
+        let rate = value.as_f64()?;
+        if currency.len() == 3
+            && currency
+                .chars()
+                .all(|character| character.is_ascii_alphabetic())
+            && rate.is_finite()
+            && (1e-12..=1e12).contains(&rate)
+        {
+            rates.insert(currency, rate);
+        }
+    }
+    rates.insert(BASE.to_string(), 1.0);
+    Some(rates)
+}
+
+fn required_rates(rates: &BTreeMap<String, f64>) -> bool {
+    ["CNY", "USD", "CAD", "HKD", "EUR", "GBP", "JPY"]
+        .iter()
+        .all(|currency| rates.get(*currency).is_some_and(|rate| *rate > 0.0))
+}
+
+fn parse_er_api(value: &Value) -> Option<FetchedRates> {
+    if value.get("result")?.as_str()? != "success"
+        || !value.get("base_code")?.as_str()?.eq_ignore_ascii_case(BASE)
+    {
+        return None;
+    }
+    let timestamp = value.get("time_last_update_unix")?.as_i64()?;
+    let rates = sanitize_rates(value.get("rates")?)?;
+    if !required_rates(&rates) {
+        return None;
+    }
+    Some(FetchedRates {
+        rates,
+        source: "er-api",
+        date: date_from_timestamp(timestamp),
+    })
+}
+
+fn parse_frankfurter(value: &Value) -> Option<FetchedRates> {
+    if !value.get("base")?.as_str()?.eq_ignore_ascii_case(BASE) {
+        return None;
+    }
+    let date = value.get("date")?.as_str()?.to_string();
+    if date.len() != 10 {
+        return None;
+    }
+    let rates = sanitize_rates(value.get("rates")?)?;
+    if !required_rates(&rates) {
+        return None;
+    }
+    Some(FetchedRates {
+        rates,
+        source: "frankfurter",
+        date,
+    })
+}
+
+fn date_from_timestamp(timestamp: i64) -> String {
+    time::OffsetDateTime::from_unix_timestamp(timestamp)
+        .map(|value| {
+            format!(
+                "{:04}-{:02}-{:02}",
+                value.year(),
+                value.month() as u8,
+                value.day()
+            )
+        })
+        .unwrap_or_default()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn default_rates_cover_frontend_currencies() {
+        let rates = default_rates();
+        for currency in [
+            "CNY", "USD", "HKD", "EUR", "GBP", "JPY", "RUB", "CHF", "INR", "VND", "THB", "CAD",
+        ] {
+            assert!(rates.contains_key(currency));
+        }
+    }
+}
diff --git a/backend/src/main.rs b/backend/src/main.rs
new file mode 100644
index 0000000..d957eef
--- /dev/null
+++ b/backend/src/main.rs
@@ -0,0 +1,296 @@
+mod auth;
+mod config;
+mod db;
+mod exchange;
+mod middleware;
+mod models;
+mod notify;
+mod routes;
+mod theme;
+mod totp;
+mod turnstile;
+mod websocket;
+
+use anyhow::{Context, Result};
+use axum::extract::DefaultBodyLimit;
+use axum::middleware as axum_middleware;
+use axum::routing::{delete, get, patch, post};
+use axum::Router;
+use clap::Parser;
+use std::collections::HashMap;
+use std::net::SocketAddr;
+use std::sync::Arc;
+use tokio::sync::{broadcast, RwLock};
+use tower_http::trace::TraceLayer;
+
+pub struct AppState {
+    pub db: db::Database,
+    pub config: config::Config,
+    pub http: reqwest::Client,
+    pub agents: RwLock<HashMap<String, websocket::AgentConnection>>,
+    pub dashboard_tx: broadcast::Sender<websocket::DashboardEvent>,
+}
+
+impl AppState {
+    pub async fn push_agent_config(&self, server_id: &str) {
+        let Some(connection) = self.agents.read().await.get(server_id).cloned() else {
+            return;
+        };
+        let config = match db::queries::agent_config(&self.db, server_id).await {
+            Ok(Some(config)) => config,
+            Ok(None) => return,
+            Err(error) => {
+                tracing::error!(%error, server_id, "failed to load Agent configuration");
+                return;
+            }
+        };
+        let payload = serde_json::json!({
+            "type": "config",
+            "ts": db::now(),
+            "config": config,
+        })
+        .to_string();
+        let _ = connection
+            .sender
+            .send(websocket::AgentCommand::Text(payload));
+    }
+
+    pub async fn disconnect_agent(&self, server_id: &str) {
+        if let Some(connection) = self.agents.write().await.remove(server_id) {
+            let _ = connection.sender.send(websocket::AgentCommand::Close);
+        }
+    }
+
+    pub async fn wake_agent(&self, server_id: &str) {
+        let Some(connection) = self.agents.read().await.get(server_id).cloned() else {
+            return;
+        };
+        let payload = serde_json::json!({
+            "type": "ack",
+            "ts": db::now(),
+            "persisted": false,
+            "persistenceError": false,
+            "persistedThroughTs": 0,
+            "nextD1WriteAfterMs": connection.report_interval.clamp(15, 3600) * 1000,
+            "nextWssReportAfterMs": connection.collect_interval.clamp(1, 60) * 1000,
+            "realtimeHint": true,
+        })
+        .to_string();
+        let _ = connection
+            .sender
+            .send(websocket::AgentCommand::Text(payload));
+    }
+
+    pub async fn send_remote_task(&self, task: &models::RemoteTaskInfo) -> bool {
+        self.agents
+            .read()
+            .await
+            .get(&task.server_id)
+            .is_some_and(|connection| websocket::agent::queue_remote_task(connection, task))
+    }
+}
+
+#[tokio::main]
+async fn main() -> Result<()> {
+    tracing_subscriber::fmt()
+        .with_env_filter(
+            tracing_subscriber::EnvFilter::try_from_default_env()
+                .unwrap_or_else(|_| "nodeflare_backend=info,tower_http=info".into()),
+        )
+        .init();
+
+    let args = config::Args::parse();
+    let mut config = config::Config::load(&args.config)?;
+    if let Some(database) = args.database {
+        config.database_url = database;
+    }
+    let bind_addr = args
+        .bind
+        .unwrap_or(config.bind_addr.parse().context("invalid bind_addr")?);
+
+    let database = db::connect(&config.database_url).await?;
+    tracing::info!(database = ?database.kind(), "connected to database");
+    database.migrate().await?;
+    db::initialize(&database, &config).await?;
+
+    for (label, path) in [
+        ("public frontend", &config.frontend_dir),
+        ("admin frontend", &config.admin_frontend_dir),
+        ("Agent installers", &config.agent_dir),
+    ] {
+        if !path.exists() {
+            tracing::warn!(label, path = %path.display(), "asset directory does not exist");
+        }
+    }
+
+    let http = reqwest::Client::builder()
+        .user_agent("NodeFlare-Standalone")
+        .connect_timeout(std::time::Duration::from_secs(5))
+        .build()?;
+    let (dashboard_tx, _) = broadcast::channel(2048);
+    let state = Arc::new(AppState {
+        db: database,
+        config,
+        http,
+        agents: RwLock::new(HashMap::new()),
+        dashboard_tx,
+    });
+
+    let protected = Router::new()
+        .route("/api/admin/logout", post(routes::auth::logout))
+        .route("/api/admin/2fa/status", get(routes::auth::get_2fa_status))
+        .route("/api/admin/2fa/setup", post(routes::auth::setup_2fa))
+        .route("/api/admin/2fa/enable", post(routes::auth::enable_2fa))
+        .route("/api/admin/2fa/disable", post(routes::auth::disable_2fa))
+        .route(
+            "/api/admin/servers",
+            get(routes::admin::servers_get)
+                .post(routes::admin::servers_post)
+                .delete(routes::admin::servers_delete),
+        )
+        .route(
+            "/api/admin/servers/order",
+            patch(routes::admin::servers_order),
+        )
+        .route(
+            "/api/admin/servers/:id/token",
+            get(routes::admin::server_token),
+        )
+        .route(
+            "/api/admin/servers/:id",
+            patch(routes::admin::server_patch).delete(routes::admin::server_delete),
+        )
+        .route(
+            "/api/admin/settings",
+            get(routes::admin::settings_get).patch(routes::admin::settings_patch),
+        )
+        .route(
+            "/api/admin/latency-tasks",
+            get(routes::admin::latency_tasks_get).post(routes::admin::latency_tasks_post),
+        )
+        .route(
+            "/api/admin/latency-tasks/:id",
+            patch(routes::admin::latency_task_patch).delete(routes::admin::latency_task_delete),
+        )
+        .route(
+            "/api/admin/alert-rules",
+            get(routes::admin::alert_rules_get).post(routes::admin::alert_rules_post),
+        )
+        .route(
+            "/api/admin/alert-rules/:id",
+            patch(routes::admin::alert_rule_patch).delete(routes::admin::alert_rule_delete),
+        )
+        .route(
+            "/api/admin/telegram",
+            get(routes::admin::telegram_get).put(routes::admin::telegram_put),
+        )
+        .route(
+            "/api/admin/telegram/test",
+            post(routes::admin::telegram_test),
+        )
+        .route(
+            "/api/admin/themes",
+            get(routes::admin::themes_get).post(routes::admin::themes_post),
+        )
+        .route(
+            "/api/admin/themes/:id/activate",
+            post(routes::admin::theme_activate),
+        )
+        .route(
+            "/api/admin/themes/:id/preview",
+            post(routes::admin::theme_preview),
+        )
+        .route("/api/admin/themes/:id", delete(routes::admin::theme_delete))
+        .route(
+            "/api/admin/theme-settings",
+            get(routes::admin::theme_settings),
+        )
+        .route(
+            "/api/admin/exchange-rates/refresh",
+            post(routes::admin::exchange_refresh),
+        )
+        .route("/api/admin/database", get(routes::admin::database_stats))
+        .route("/api/admin/history", delete(routes::admin::history_delete))
+        .route("/api/admin/remote/task", post(routes::remote::create_task))
+        .route("/api/admin/remote/task/:id", get(routes::remote::get_task))
+        .route(
+            "/api/admin/remote/tasks/:server_id",
+            get(routes::remote::get_server_tasks),
+        )
+        .layer(axum_middleware::from_fn_with_state(
+            Arc::clone(&state),
+            middleware::auth_middleware,
+        ));
+
+    let app = Router::new()
+        .route("/api/bootstrap", get(routes::public::bootstrap))
+        .route("/api/config", get(routes::public::config))
+        .route("/api/servers", get(routes::public::servers))
+        .route("/api/history/:id", get(routes::public::history))
+        .route("/api/latency/:id", get(routes::public::latency_history))
+        .route("/api/exchange-rates", get(routes::public::exchange_rates))
+        .route("/api/live/wake", post(routes::public::wake_servers))
+        .route(
+            "/api/turnstile/verify",
+            post(routes::auth::verify_turnstile),
+        )
+        .route("/api/admin/login", post(routes::auth::login))
+        .route("/api/agent/ws", get(websocket::agent::handle))
+        .route("/api/ws", get(websocket::dashboard::handle))
+        .merge(protected)
+        .fallback(routes::site::handle)
+        .layer(DefaultBodyLimit::max(2 * 1024 * 1024))
+        .layer(TraceLayer::new_for_http())
+        .layer(axum_middleware::from_fn(middleware::security_headers))
+        .with_state(Arc::clone(&state));
+
+    spawn_maintenance(Arc::clone(&state));
+    let listener = tokio::net::TcpListener::bind(bind_addr).await?;
+    tracing::info!(address = %bind_addr, "NodeFlare listening");
+    axum::serve(
+        listener,
+        app.into_make_service_with_connect_info::<SocketAddr>(),
+    )
+    .with_graceful_shutdown(shutdown_signal())
+    .await?;
+    Ok(())
+}
+
+fn spawn_maintenance(state: Arc<AppState>) {
+    tokio::spawn(async move {
+        let mut interval = tokio::time::interval(std::time::Duration::from_secs(60));
+        loop {
+            interval.tick().await;
+            if let Err(error) = db::cleanup_auth(&state.db).await {
+                tracing::error!(%error, "session cleanup failed");
+            }
+            if let Err(error) = db::queries::cleanup_theme_previews(&state.db).await {
+                tracing::error!(%error, "theme preview cleanup failed");
+            }
+            let settings = match db::load_settings(&state.db).await {
+                Ok(settings) => settings,
+                Err(error) => {
+                    tracing::error!(%error, "maintenance settings load failed");
+                    continue;
+                }
+            };
+            if let Err(error) = notify::run_periodic(&state.db, &state.http, &settings).await {
+                tracing::error!(%error, "notification maintenance failed");
+            }
+            if let Err(error) =
+                db::queries::cleanup_history(&state.db, settings.history_retention_days).await
+            {
+                tracing::error!(%error, "history cleanup failed");
+            }
+            if let Err(error) = exchange::refresh(&state.db, &state.http, false).await {
+                tracing::warn!(%error, "scheduled exchange-rate refresh failed");
+            }
+        }
+    });
+}
+
+async fn shutdown_signal() {
+    if tokio::signal::ctrl_c().await.is_ok() {
+        tracing::info!("shutdown signal received");
+    }
+}
diff --git a/backend/src/middleware.rs b/backend/src/middleware.rs
new file mode 100644
index 0000000..0abec1c
--- /dev/null
+++ b/backend/src/middleware.rs
@@ -0,0 +1,63 @@
+use axum::{
+    extract::{Request, State},
+    http::{HeaderName, HeaderValue},
+    middleware::Next,
+    response::{IntoResponse, Response},
+};
+use std::sync::Arc;
+
+use crate::routes::{bearer_or_cookie, ApiResponse};
+use crate::AppState;
+
+pub async fn auth_middleware(
+    State(state): State<Arc<AppState>>,
+    mut request: Request,
+    next: Next,
+) -> Response {
+    let Some(token) = bearer_or_cookie(request.headers()) else {
+        return ApiResponse::unauthorized("请先登录").into_response();
+    };
+    match crate::db::session_username(&state.db, &token).await {
+        Ok(Some(username)) => {
+            request
+                .extensions_mut()
+                .insert(AuthenticatedUser { username });
+            next.run(request).await
+        }
+        Ok(None) => ApiResponse::unauthorized("登录状态已过期").into_response(),
+        Err(error) => ApiResponse::internal(error).into_response(),
+    }
+}
+
+#[derive(Clone)]
+pub struct AuthenticatedUser {
+    pub username: String,
+}
+
+pub async fn security_headers(request: Request, next: Next) -> Response {
+    let mut response = next.run(request).await;
+    let headers = response.headers_mut();
+    headers.insert(
+        HeaderName::from_static("x-content-type-options"),
+        HeaderValue::from_static("nosniff"),
+    );
+    headers.insert(
+        HeaderName::from_static("x-frame-options"),
+        HeaderValue::from_static("DENY"),
+    );
+    headers.insert(
+        HeaderName::from_static("referrer-policy"),
+        HeaderValue::from_static("strict-origin-when-cross-origin"),
+    );
+    headers.insert(
+        HeaderName::from_static("permissions-policy"),
+        HeaderValue::from_static("camera=(), microphone=(), geolocation=()"),
+    );
+    headers.insert(
+        HeaderName::from_static("content-security-policy"),
+        HeaderValue::from_static(
+            "default-src 'self'; script-src 'self' https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' ws: wss:; frame-src https://challenges.cloudflare.com; font-src 'self' data:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'",
+        ),
+    );
+    response
+}
diff --git a/src/models.rs b/backend/src/models.rs
similarity index 65%
rename from src/models.rs
rename to backend/src/models.rs
index ae571d0..f794237 100644
--- a/src/models.rs
+++ b/backend/src/models.rs
@@ -1,11 +1,5 @@
-use serde::{Deserialize, Serialize, Serializer};
-
-fn serialize_sqlite_bool<S>(value: &i64, serializer: S) -> Result<S::Ok, S::Error>
-where
-    S: Serializer,
-{
-    serializer.serialize_bool(*value != 0)
-}
+use serde::{Deserialize, Serialize};
+use std::collections::BTreeMap;
 
 #[derive(Debug, Deserialize)]
 #[serde(deny_unknown_fields)]
@@ -13,7 +7,10 @@ pub struct LoginRequest {
     pub username: String,
     pub password: String,
     pub password_derived: String,
+    #[serde(default)]
     pub turnstile_token: String,
+    #[serde(default)]
+    pub totp_code: String,
 }
 
 #[derive(Debug, Deserialize)]
@@ -22,7 +19,7 @@ pub struct TurnstileVerifyRequest {
     pub token: String,
 }
 
-#[derive(Debug, Deserialize)]
+#[derive(Debug, Clone, Deserialize, Serialize)]
 #[serde(deny_unknown_fields)]
 pub struct ServerInput {
     pub name: String,
@@ -48,7 +45,7 @@ pub struct ServerInput {
     pub auto_update: bool,
 }
 
-#[derive(Debug, Deserialize)]
+#[derive(Debug, Clone, Deserialize, Serialize)]
 #[serde(deny_unknown_fields)]
 pub struct SettingsInput {
     pub site_name: Option<String>,
@@ -84,108 +81,54 @@ pub struct SettingsInput {
     pub offline_alert_minutes: Option<i64>,
     pub expiry_alert_days: Option<i64>,
     pub traffic_alert_percentage: Option<i64>,
-    pub cloudflare_account_id: Option<String>,
-    pub cloudflare_api_token: Option<String>,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct TelegramNotificationInput {
-    pub bot_token: String,
-    pub chat_id: String,
-    #[serde(default)]
-    pub message_thread_id: Option<i64>,
-    pub template: String,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct ThemeInput {
-    pub name: String,
-    pub description: String,
-    pub url: String,
 }
 
 #[derive(Debug, Clone, Serialize)]
-pub struct ThemeView {
-    pub id: String,
-    pub name: String,
-    pub description: String,
-    pub url: String,
-    pub version: String,
-    pub builtin: bool,
-    pub active: bool,
+pub struct PublicConfig {
+    pub site_name: String,
+    pub site_description: String,
+    pub site_announcement: String,
+    pub logo_url: String,
+    pub locale: String,
+    pub public_dashboard: bool,
+    pub offline_threshold_seconds: i64,
+    pub history_retention_days: i64,
+    pub default_theme: String,
+    pub active_theme_id: String,
+    pub background_url: String,
+    pub theme_options: serde_json::Value,
+    pub show_search: bool,
+    pub show_groups: bool,
+    pub show_stats: bool,
+    pub show_assets: bool,
+    pub show_traffic: bool,
+    pub show_speed: bool,
+    pub show_price: bool,
+    pub show_expiry: bool,
+    pub show_latency: bool,
+    pub show_uptime: bool,
+    pub turnstile_enabled: bool,
+    pub turnstile_login_enabled: bool,
+    pub turnstile_site_key: String,
+    #[serde(skip_serializing_if = "String::is_empty")]
+    pub password_client_salt: String,
 }
 
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct ServerOrderInput {
-    pub ids: Vec<String>,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct ServerBatchInput {
-    pub ids: Vec<String>,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct LatencyTaskInput {
-    pub name: String,
-    pub task_type: String,
-    pub target: String,
-    pub port: Option<i64>,
-    pub interval_seconds: i64,
-    pub default_enabled: bool,
-    pub server_ids: Vec<String>,
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
-pub struct AgentLatencyTask {
-    pub id: String,
-    pub name: String,
-    pub task_type: String,
-    pub target: String,
-    pub port: Option<i64>,
-    pub interval_seconds: i64,
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize)]
-#[serde(deny_unknown_fields)]
-pub struct AgentLatencyResult {
-    pub task_id: String,
-    pub timestamp: i64,
-    pub latency_ms: f64,
-    pub packet_loss: f64,
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize)]
-#[serde(deny_unknown_fields)]
-pub struct AgentDiskMetric {
-    pub name: String,
-    pub mount_point: String,
-    pub used: i64,
-    pub total: i64,
-    pub read_bps: f64,
-    pub write_bps: f64,
-    pub read_iops: f64,
-    pub write_iops: f64,
-    pub await_ms: f64,
-    pub utilization: f64,
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize)]
-#[serde(deny_unknown_fields)]
-pub struct AgentGpuMetric {
-    pub model: String,
-    pub usage: Option<f64>,
-    pub memory_used: i64,
-    pub memory_total: i64,
+#[derive(Debug, Clone, Serialize)]
+pub struct SettingsView {
+    #[serde(flatten)]
+    pub public: PublicConfig,
+    pub admin_username: String,
+    pub admin_password_configured: bool,
+    pub turnstile_secret_key: String,
+    pub notification_enabled: bool,
+    pub offline_alert_minutes: i64,
+    pub expiry_alert_days: i64,
+    pub traffic_alert_percentage: i64,
 }
 
 #[derive(Debug, Clone, Default, Deserialize, Serialize)]
-#[serde(deny_unknown_fields)]
+#[serde(default, deny_unknown_fields)]
 pub struct AgentReport {
     pub timestamp: i64,
     pub cpu: f64,
@@ -215,7 +158,6 @@ pub struct AgentReport {
     pub gpu_usage: f64,
     pub gpu_model: String,
     pub agent_version: String,
-    /// 双栈公网地址，agent 双栈探测的结果；空串表示当前不可用或探测尚未完成。
     pub ip_v4: String,
     pub ip_v6: String,
     pub disk_read_bps: f64,
@@ -229,26 +171,57 @@ pub struct AgentReport {
     pub latency_results: Vec<AgentLatencyResult>,
 }
 
-#[derive(Debug, Deserialize, Serialize)]
+#[derive(Debug, Clone, Default, Deserialize, Serialize)]
+#[serde(default, deny_unknown_fields)]
+pub struct AgentDiskMetric {
+    pub name: String,
+    pub mount_point: String,
+    pub used: i64,
+    pub total: i64,
+    pub read_bps: f64,
+    pub write_bps: f64,
+    pub read_iops: f64,
+    pub write_iops: f64,
+    pub await_ms: f64,
+    pub utilization: f64,
+}
+
+#[derive(Debug, Clone, Default, Deserialize, Serialize)]
+#[serde(default, deny_unknown_fields)]
+pub struct AgentGpuMetric {
+    pub model: String,
+    pub usage: Option<f64>,
+    pub memory_used: i64,
+    pub memory_total: i64,
+}
+
+#[derive(Debug, Clone, Default, Deserialize, Serialize)]
+#[serde(default, deny_unknown_fields)]
+pub struct AgentLatencyResult {
+    pub task_id: String,
+    pub timestamp: i64,
+    pub latency_ms: f64,
+    pub packet_loss: f64,
+}
+
+#[derive(Debug, Clone, Serialize)]
 pub struct ServerView {
     pub id: String,
     pub name: String,
     pub region: String,
     pub group_name: String,
     pub tags: String,
-    #[serde(serialize_with = "serialize_sqlite_bool")]
-    pub hidden: i64,
+    pub hidden: bool,
     pub expires_at: Option<i64>,
     pub traffic_limit: i64,
     pub traffic_limit_type: String,
     pub price: f64,
     pub billing_cycle: i64,
     pub currency: String,
-    #[serde(serialize_with = "serialize_sqlite_bool")]
-    pub auto_renewal: i64,
+    pub auto_renewal: bool,
     pub last_ip: String,
-    pub ip_v4: Option<String>,
-    pub ip_v6: Option<String>,
+    pub ip_v4: String,
+    pub ip_v6: String,
     pub network_interface: String,
     pub reset_day: i64,
     pub report_interval: i64,
@@ -256,12 +229,8 @@ pub struct ServerView {
     pub rx_correction: i64,
     pub tx_correction: i64,
     pub agent_mirror: String,
-    #[serde(serialize_with = "serialize_sqlite_bool")]
-    pub offline_notify_disabled: i64,
-    #[serde(serialize_with = "serialize_sqlite_bool")]
-    pub auto_update: i64,
-    #[serde(skip_serializing)]
-    pub created_at: i64,
+    pub offline_notify_disabled: bool,
+    pub auto_update: bool,
     pub timestamp: Option<i64>,
     pub cpu: Option<f64>,
     pub load1: Option<f64>,
@@ -296,13 +265,12 @@ pub struct ServerView {
     pub disk_write_iops: Option<f64>,
     pub disk_await_ms: Option<f64>,
     pub disk_utilization: Option<f64>,
-    #[serde(skip_serializing)]
-    pub disk_info: Option<String>,
-    #[serde(skip_serializing)]
-    pub gpu_info: Option<String>,
+    pub disks: Vec<AgentDiskMetric>,
+    pub gpus: Vec<AgentGpuMetric>,
+    pub latency: Vec<LatencySample>,
 }
 
-#[derive(Debug, Clone, Default, Deserialize, Serialize)]
+#[derive(Debug, Clone, Default, Serialize)]
 pub struct HistoryPoint {
     pub timestamp: i64,
     pub cpu: f64,
@@ -331,23 +299,54 @@ pub struct HistoryPoint {
     pub disk_utilization: f64,
 }
 
-#[derive(Debug, Deserialize)]
-pub struct AgentIdentityRow {
+#[derive(Debug, Clone, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct LatencyTaskInput {
+    pub name: String,
+    pub task_type: String,
+    pub target: String,
+    pub port: Option<i64>,
+    pub interval_seconds: i64,
+    pub default_enabled: bool,
+    pub server_ids: Vec<String>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct LatencyTaskView {
     pub id: String,
-    pub hidden: i64,
+    pub name: String,
+    pub task_type: String,
+    pub target: String,
+    pub port: Option<i64>,
+    pub interval_seconds: i64,
+    pub default_enabled: bool,
+    pub server_ids: Vec<String>,
 }
 
-#[derive(Debug, Serialize)]
-pub struct AgentConfigView {
-    pub report_interval: i64,
-    pub collect_interval: i64,
-    pub network_interface: String,
-    pub agent_mirror: String,
-    pub auto_update: bool,
-    pub latency_tasks: Vec<AgentLatencyTask>,
+#[derive(Debug, Clone, Serialize)]
+pub struct AgentLatencyTask {
+    pub id: String,
+    pub name: String,
+    pub task_type: String,
+    pub target: String,
+    pub port: Option<i64>,
+    pub interval_seconds: i64,
 }
 
-#[derive(Debug, Deserialize)]
+#[derive(Debug, Clone, Default, Serialize)]
+pub struct LatencySample {
+    pub task_id: String,
+    pub server_id: String,
+    pub name: String,
+    pub task_type: String,
+    pub target: String,
+    pub port: Option<i64>,
+    pub timestamp: i64,
+    pub latency_ms: f64,
+    pub packet_loss: f64,
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
 #[serde(deny_unknown_fields)]
 pub struct AlertRuleInput {
     pub name: String,
@@ -359,7 +358,7 @@ pub struct AlertRuleInput {
     pub server_ids: Vec<String>,
 }
 
-#[derive(Debug, Clone, Deserialize, Serialize)]
+#[derive(Debug, Clone, Serialize)]
 pub struct AlertRuleView {
     pub id: String,
     pub name: String,
@@ -371,9 +370,133 @@ pub struct AlertRuleView {
     pub server_ids: Vec<String>,
 }
 
-#[derive(Debug, Serialize)]
-pub struct ApiError<'a> {
-    pub error: &'a str,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub request_id: Option<&'a str>,
+#[derive(Debug, Clone, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct TelegramSettingsInput {
+    pub bot_token: String,
+    pub chat_id: String,
+    #[serde(default)]
+    pub message_thread_id: Option<i64>,
+    pub template: String,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct TelegramSettingsView {
+    pub bot_token: String,
+    pub chat_id: String,
+    pub message_thread_id: Option<i64>,
+    pub template: String,
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct ThemeInput {
+    pub name: String,
+    pub description: String,
+    pub url: String,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct ThemeView {
+    pub id: String,
+    pub name: String,
+    pub description: String,
+    pub url: String,
+    pub version: String,
+    pub builtin: bool,
+    pub active: bool,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ServerOrderInput {
+    pub ids: Vec<String>,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ServerBatchInput {
+    pub ids: Vec<String>,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct WakeServersInput {
+    pub server_ids: Vec<String>,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Enable2FaRequest {
+    pub totp_code: String,
+}
+
+#[derive(Debug, Serialize)]
+pub struct TotpSetupResponse {
+    pub secret: String,
+    pub uri: String,
+    pub enabled: bool,
+}
+
+#[derive(Debug, Serialize)]
+pub struct TotpStatusResponse {
+    pub enabled: bool,
+    pub has_secret: bool,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct CreateRemoteTaskRequest {
+    pub server_id: String,
+    #[serde(default)]
+    pub command: String,
+    #[serde(default)]
+    pub script: String,
+    #[serde(default)]
+    pub totp_code: String,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct RemoteTaskInfo {
+    pub id: String,
+    pub server_id: String,
+    pub command: String,
+    pub script: String,
+    pub status: String,
+    pub requested_by: String,
+    pub requested_at: i64,
+    pub started_at: Option<i64>,
+    pub completed_at: Option<i64>,
+    pub result: String,
+    pub exit_code: Option<i64>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct DatabaseStats {
+    pub server_count: i64,
+    pub online_count: i64,
+    pub history_rows: i64,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct ExchangeRatesView {
+    pub base: String,
+    pub rates: BTreeMap<String, f64>,
+    pub source: String,
+    pub date: String,
+    pub fetched_at: i64,
+    pub stale: bool,
+}
+
+#[derive(Debug, Serialize)]
+pub struct ApiError {
+    pub error: String,
+}
+
+impl ApiError {
+    pub fn new(message: impl Into<String>) -> Self {
+        Self {
+            error: message.into(),
+        }
+    }
 }
diff --git a/backend/src/notify.rs b/backend/src/notify.rs
new file mode 100644
index 0000000..f9ceafe
--- /dev/null
+++ b/backend/src/notify.rs
@@ -0,0 +1,288 @@
+use crate::db::{self, queries, Database, Settings};
+use crate::models::TelegramSettingsView;
+use anyhow::{Context, Result};
+use serde_json::Value;
+use std::time::Duration;
+
+pub async fn test_telegram(db: &Database, client: &reqwest::Client) -> Result<()> {
+    send(
+        db,
+        client,
+        "NodeFlare 测试通知",
+        "NodeFlare",
+        "Telegram 通知配置有效。",
+    )
+    .await
+}
+
+pub async fn evaluate_resource_alerts(
+    db: &Database,
+    client: &reqwest::Client,
+    settings: &Settings,
+    server_id: &str,
+    server_name: &str,
+) -> Result<()> {
+    if !settings.notification_enabled {
+        return Ok(());
+    }
+    for evaluation in queries::evaluate_resource_rules(db, server_id).await? {
+        let key = format!("resource:{}:{server_id}", evaluation.rule.id);
+        let details = serde_json::json!({
+            "value": evaluation.value,
+            "threshold": evaluation.rule.threshold,
+            "metric": evaluation.rule.metric,
+        });
+        if !queries::update_alert_state(db, &key, evaluation.triggered, &details).await? {
+            continue;
+        }
+        let unit = if evaluation.rule.metric.starts_with("net_") {
+            "MiB/s"
+        } else {
+            "%"
+        };
+        let (title, message) = if evaluation.triggered {
+            (
+                "资源告警",
+                format!(
+                    "{}：{:.2} {}，阈值 {:.2} {}（{} 分钟{}）",
+                    evaluation.rule.name,
+                    evaluation.value,
+                    unit,
+                    evaluation.rule.threshold,
+                    unit,
+                    evaluation.rule.duration_minutes,
+                    if evaluation.rule.aggregation == "continuous" {
+                        "持续超限"
+                    } else {
+                        "平均值"
+                    }
+                ),
+            )
+        } else {
+            (
+                "资源恢复",
+                format!(
+                    "{} 已恢复，当前值 {:.2} {}",
+                    evaluation.rule.name, evaluation.value, unit
+                ),
+            )
+        };
+        if let Err(error) = send(db, client, title, server_name, &message).await {
+            tracing::error!(%error, server_id, rule_id = %evaluation.rule.id, "resource alert notification failed");
+        }
+    }
+    Ok(())
+}
+
+pub async fn run_periodic(
+    db: &Database,
+    client: &reqwest::Client,
+    settings: &Settings,
+) -> Result<()> {
+    if !settings.notification_enabled {
+        return Ok(());
+    }
+    let current = db::now();
+    for server in queries::list_servers(db, true).await? {
+        if !server.offline_notify_disabled {
+            let offline = server.timestamp.is_none_or(|timestamp| {
+                current.saturating_sub(timestamp) >= settings.offline_alert_minutes * 60
+            });
+            let key = format!("offline:{}", server.id);
+            if queries::update_alert_state(
+                db,
+                &key,
+                offline,
+                &serde_json::json!({"timestamp": server.timestamp}),
+            )
+            .await?
+            {
+                let (title, message) = if offline {
+                    (
+                        "服务器离线",
+                        format!(
+                            "超过 {} 分钟未收到 Agent 上报",
+                            settings.offline_alert_minutes
+                        ),
+                    )
+                } else {
+                    ("服务器恢复在线", "已重新收到 Agent 上报".to_string())
+                };
+                notify_best_effort(db, client, title, &server.name, &message).await;
+            }
+        }
+
+        if let Some(expires_at) = server.expires_at {
+            let expiring = settings.expiry_alert_days > 0
+                && expires_at >= current
+                && expires_at - current <= settings.expiry_alert_days * 86_400;
+            let key = format!("expiry:{}", server.id);
+            if queries::update_alert_state(
+                db,
+                &key,
+                expiring,
+                &serde_json::json!({"expires_at": expires_at}),
+            )
+            .await?
+                && expiring
+            {
+                let days = (expires_at - current + 86_399) / 86_400;
+                notify_best_effort(
+                    db,
+                    client,
+                    "服务器即将到期",
+                    &server.name,
+                    &format!("预计还有 {days} 天到期"),
+                )
+                .await;
+            }
+        }
+
+        if server.traffic_limit > 0 {
+            let rx = server.net_rx_total.unwrap_or_default().max(0);
+            let tx = server.net_tx_total.unwrap_or_default().max(0);
+            let used = match server.traffic_limit_type.as_str() {
+                "max" => rx.max(tx),
+                "min" => rx.min(tx),
+                "up" => tx,
+                "down" => rx,
+                _ => rx.saturating_add(tx),
+            };
+            let percentage = used as f64 / server.traffic_limit as f64 * 100.0;
+            for milestone in traffic_milestones(settings.traffic_alert_percentage) {
+                let exceeded = percentage >= milestone as f64;
+                let key = format!("traffic:{}:{milestone}", server.id);
+                if queries::update_alert_state(
+                    db,
+                    &key,
+                    exceeded,
+                    &serde_json::json!({"percentage": percentage, "milestone": milestone}),
+                )
+                .await?
+                    && exceeded
+                {
+                    notify_best_effort(
+                        db,
+                        client,
+                        "流量告警",
+                        &server.name,
+                        &format!(
+                            "当前周期已使用 {:.1}% 的流量额度（达到 {milestone}% 提醒线）",
+                            percentage
+                        ),
+                    )
+                    .await;
+                }
+            }
+        }
+    }
+    Ok(())
+}
+
+fn traffic_milestones(start: i64) -> Vec<i64> {
+    let mut milestones = vec![start.clamp(50, 100)];
+    while *milestones.last().unwrap_or(&100) < 100 {
+        let next = (*milestones.last().unwrap_or(&100) + 5).min(100);
+        milestones.push(next);
+    }
+    milestones
+}
+
+async fn notify_best_effort(
+    db: &Database,
+    client: &reqwest::Client,
+    title: &str,
+    server: &str,
+    message: &str,
+) {
+    if let Err(error) = send(db, client, title, server, message).await {
+        tracing::error!(%error, title, server, "Telegram notification failed");
+    }
+}
+
+async fn send(
+    db: &Database,
+    client: &reqwest::Client,
+    title: &str,
+    server: &str,
+    message: &str,
+) -> Result<()> {
+    let settings = queries::raw_telegram_settings(db)
+        .await?
+        .context("尚未配置 Telegram")?;
+    validate_settings(&settings)?;
+    let text = render(&settings.template, title, server, message);
+    let mut payload = serde_json::json!({
+        "chat_id": settings.chat_id,
+        "text": text,
+        "disable_web_page_preview": true,
+    });
+    if let Some(thread_id) = settings.message_thread_id {
+        payload["message_thread_id"] = Value::from(thread_id);
+    }
+    let response = client
+        .post(format!(
+            "https://api.telegram.org/bot{}/sendMessage",
+            settings.bot_token
+        ))
+        .timeout(Duration::from_secs(10))
+        .json(&payload)
+        .send()
+        .await?
+        .error_for_status()?;
+    let body = response.bytes().await?;
+    if body.len() > 64 * 1024 {
+        anyhow::bail!("Telegram response is too large");
+    }
+    let value: Value = serde_json::from_slice(&body)?;
+    if value.get("ok").and_then(Value::as_bool) != Some(true) {
+        anyhow::bail!("Telegram rejected the message");
+    }
+    Ok(())
+}
+
+fn validate_settings(settings: &TelegramSettingsView) -> Result<()> {
+    if settings.bot_token.trim().is_empty()
+        || settings.bot_token.len() > 512
+        || settings.bot_token.chars().any(char::is_whitespace)
+    {
+        anyhow::bail!("Telegram Bot Token 无效");
+    }
+    if settings.chat_id.trim().is_empty() || settings.chat_id.len() > 128 {
+        anyhow::bail!("Telegram Chat ID 无效");
+    }
+    if settings.template.trim().is_empty() || settings.template.chars().count() > 4000 {
+        anyhow::bail!("Telegram 消息模板无效");
+    }
+    Ok(())
+}
+
+fn render(template: &str, title: &str, server: &str, message: &str) -> String {
+    let timestamp = time::OffsetDateTime::now_utc();
+    let time = format!(
+        "{:04}-{:02}-{:02} {:02}:{:02}:{:02} UTC",
+        timestamp.year(),
+        timestamp.month() as u8,
+        timestamp.day(),
+        timestamp.hour(),
+        timestamp.minute(),
+        timestamp.second()
+    );
+    template
+        .replace("{{title}}", title)
+        .replace("{{server}}", server)
+        .replace("{{message}}", message)
+        .replace("{{time}}", &time)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::traffic_milestones;
+
+    #[test]
+    fn traffic_alerts_advance_in_five_percent_steps() {
+        assert_eq!(traffic_milestones(80), vec![80, 85, 90, 95, 100]);
+        assert_eq!(traffic_milestones(98), vec![98, 100]);
+        assert_eq!(traffic_milestones(100), vec![100]);
+    }
+}
diff --git a/backend/src/routes/admin.rs b/backend/src/routes/admin.rs
new file mode 100644
index 0000000..fa75b11
--- /dev/null
+++ b/backend/src/routes/admin.rs
@@ -0,0 +1,821 @@
+use super::{admin_cookie, request_is_secure, ApiResponse};
+use crate::db::SECRET_MASK;
+use crate::middleware::AuthenticatedUser;
+use crate::models::{
+    AlertRuleInput, LatencyTaskInput, ServerBatchInput, ServerInput, ServerOrderInput,
+    SettingsInput, TelegramSettingsInput, ThemeInput,
+};
+use crate::AppState;
+use axum::extract::{Extension, Path, State};
+use axum::http::{header::SET_COOKIE, HeaderMap, HeaderValue, StatusCode};
+use axum::response::{IntoResponse, Response};
+use axum::Json;
+use sha2::{Digest, Sha256};
+use std::collections::HashSet;
+use std::net::Ipv4Addr;
+use std::sync::Arc;
+use url::Url;
+
+pub async fn servers_get(State(state): State<Arc<AppState>>) -> Result<Response, ApiResponse> {
+    let servers = crate::db::queries::list_servers(&state.db, true)
+        .await
+        .map_err(ApiResponse::internal)?;
+    Ok(Json(serde_json::json!({"servers": servers})).into_response())
+}
+
+pub async fn servers_post(
+    State(state): State<Arc<AppState>>,
+    Json(input): Json<ServerInput>,
+) -> Result<Response, ApiResponse> {
+    validate_server(&input).map_err(ApiResponse::bad_request)?;
+    let (id, token) = crate::db::queries::create_server(&state.db, &input)
+        .await
+        .map_err(ApiResponse::internal)?;
+    Ok((
+        StatusCode::CREATED,
+        Json(serde_json::json!({"id": id, "agent_token": token})),
+    )
+        .into_response())
+}
+
+pub async fn server_patch(
+    State(state): State<Arc<AppState>>,
+    Path(id): Path<String>,
+    Json(input): Json<ServerInput>,
+) -> Result<Response, ApiResponse> {
+    validate_id(&id)?;
+    validate_server(&input).map_err(ApiResponse::bad_request)?;
+    if !crate::db::queries::update_server(&state.db, &id, &input)
+        .await
+        .map_err(ApiResponse::internal)?
+    {
+        return Err(ApiResponse::not_found("节点不存在"));
+    }
+    state.push_agent_config(&id).await;
+    Ok(StatusCode::NO_CONTENT.into_response())
+}
+
+pub async fn server_delete(
+    State(state): State<Arc<AppState>>,
+    Path(id): Path<String>,
+) -> Result<Response, ApiResponse> {
+    validate_id(&id)?;
+    if !crate::db::queries::delete_server(&state.db, &id)
+        .await
+        .map_err(ApiResponse::internal)?
+    {
+        return Err(ApiResponse::not_found("节点不存在"));
+    }
+    state.disconnect_agent(&id).await;
+    Ok(StatusCode::NO_CONTENT.into_response())
+}
+
+pub async fn servers_delete(
+    State(state): State<Arc<AppState>>,
+    Json(input): Json<ServerBatchInput>,
+) -> Result<Response, ApiResponse> {
+    validate_ids(&input.ids)?;
+    crate::db::queries::delete_servers(&state.db, &input.ids)
+        .await
+        .map_err(ApiResponse::internal)?;
+    for id in input.ids {
+        state.disconnect_agent(&id).await;
+    }
+    Ok(StatusCode::NO_CONTENT.into_response())
+}
+
+pub async fn servers_order(
+    State(state): State<Arc<AppState>>,
+    Json(input): Json<ServerOrderInput>,
+) -> Result<Response, ApiResponse> {
+    validate_ids(&input.ids)?;
+    let current = crate::db::queries::all_server_ids(&state.db)
+        .await
+        .map_err(ApiResponse::internal)?;
+    if current.len() != input.ids.len() || input.ids.iter().any(|id| !current.contains(id)) {
+        return Err(ApiResponse::bad_request("排序列表必须包含全部节点"));
+    }
+    crate::db::queries::reorder_servers(&state.db, &input.ids)
+        .await
+        .map_err(ApiResponse::internal)?;
+    Ok(StatusCode::NO_CONTENT.into_response())
+}
+
+pub async fn server_token(
+    State(state): State<Arc<AppState>>,
+    Path(id): Path<String>,
+) -> Result<Response, ApiResponse> {
+    validate_id(&id)?;
+    let token = crate::db::queries::server_token(&state.db, &id)
+        .await
+        .map_err(ApiResponse::internal)?
+        .ok_or_else(|| ApiResponse::not_found("节点不存在"))?;
+    Ok(Json(serde_json::json!({"agent_token": token})).into_response())
+}
+
+pub async fn settings_get(State(state): State<Arc<AppState>>) -> Result<Response, ApiResponse> {
+    let settings = crate::db::load_settings(&state.db)
+        .await
+        .map_err(ApiResponse::internal)?;
+    Ok(Json(settings.admin_view()).into_response())
+}
+
+pub async fn settings_patch(
+    State(state): State<Arc<AppState>>,
+    Extension(user): Extension<AuthenticatedUser>,
+    headers: HeaderMap,
+    Json(mut input): Json<SettingsInput>,
+) -> Result<Response, ApiResponse> {
+    let current = crate::db::load_settings(&state.db)
+        .await
+        .map_err(ApiResponse::internal)?;
+    validate_settings(&state, &current, &input).await?;
+    let password_hash = match input
+        .new_password
+        .as_deref()
+        .filter(|value| !value.is_empty())
+    {
+        Some(_) => Some(
+            crate::auth::hash_password(input.new_password_derived.as_deref().unwrap_or_default())
+                .map_err(ApiResponse::internal)?,
+        ),
+        None => None,
+    };
+    let next_username = input
+        .admin_username
+        .as_deref()
+        .map(str::trim)
+        .unwrap_or(&current.admin_username)
+        .to_string();
+    let username_changed = next_username != user.username;
+    if !username_changed {
+        input.admin_username = None;
+    }
+    crate::db::update_settings(&state.db, &input, password_hash.as_deref())
+        .await
+        .map_err(ApiResponse::internal)?;
+    crate::db::queries::rename_totp_user(&state.db, &user.username, &next_username)
+        .await
+        .map_err(ApiResponse::internal)?;
+    let credentials_changed = password_hash.is_some() || username_changed;
+    let token = if credentials_changed {
+        Some(
+            crate::db::create_session(&state.db, &next_username, state.config.session_ttl_hours)
+                .await
+                .map_err(ApiResponse::internal)?,
+        )
+    } else {
+        None
+    };
+    let updated = crate::db::load_settings(&state.db)
+        .await
+        .map_err(ApiResponse::internal)?;
+    let mut response = Json(serde_json::json!({
+        "settings": updated.admin_view(),
+        "token": token,
+    }))
+    .into_response();
+    if let Some(token) = token {
+        response.headers_mut().append(
+            SET_COOKIE,
+            HeaderValue::from_str(&admin_cookie(
+                &token,
+                state.config.session_ttl_hours * 3600,
+                request_is_secure(&headers),
+            ))
+            .map_err(ApiResponse::internal)?,
+        );
+    }
+    Ok(response)
+}
+
+pub async fn latency_tasks_get(
+    State(state): State<Arc<AppState>>,
+) -> Result<Response, ApiResponse> {
+    let tasks = crate::db::queries::list_latency_tasks(&state.db)
+        .await
+        .map_err(ApiResponse::internal)?;
+    Ok(Json(serde_json::json!({"tasks": tasks})).into_response())
+}
+
+pub async fn latency_tasks_post(
+    State(state): State<Arc<AppState>>,
+    Json(input): Json<LatencyTaskInput>,
+) -> Result<Response, ApiResponse> {
+    validate_latency_task(&state, &input).await?;
+    if crate::db::queries::list_latency_tasks(&state.db)
+        .await
+        .map_err(ApiResponse::internal)?
+        .len()
+        >= 128
+    {
+        return Err(ApiResponse::bad_request("最多可创建 128 个延迟任务"));
+    }
+    let id = crate::db::queries::create_latency_task(&state.db, &input)
+        .await
+        .map_err(ApiResponse::internal)?;
+    for server_id in &input.server_ids {
+        state.push_agent_config(server_id).await;
+    }
+    Ok((StatusCode::CREATED, Json(serde_json::json!({"id": id}))).into_response())
+}
+
+pub async fn latency_task_patch(
+    State(state): State<Arc<AppState>>,
+    Path(id): Path<String>,
+    Json(input): Json<LatencyTaskInput>,
+) -> Result<Response, ApiResponse> {
+    validate_id(&id)?;
+    validate_latency_task(&state, &input).await?;
+    let mut affected = crate::db::queries::latency_task_server_ids(&state.db, &id)
+        .await
+        .map_err(ApiResponse::internal)?;
+    affected.extend(input.server_ids.iter().cloned());
+    affected.sort();
+    affected.dedup();
+    if !crate::db::queries::update_latency_task(&state.db, &id, &input)
+        .await
+        .map_err(ApiResponse::internal)?
+    {
+        return Err(ApiResponse::not_found("延迟任务不存在"));
+    }
+    for server_id in affected {
+        state.push_agent_config(&server_id).await;
+    }
+    Ok(StatusCode::NO_CONTENT.into_response())
+}
+
+pub async fn latency_task_delete(
+    State(state): State<Arc<AppState>>,
+    Path(id): Path<String>,
+) -> Result<Response, ApiResponse> {
+    validate_id(&id)?;
+    let affected = crate::db::queries::latency_task_server_ids(&state.db, &id)
+        .await
+        .map_err(ApiResponse::internal)?;
+    if !crate::db::queries::delete_latency_task(&state.db, &id)
+        .await
+        .map_err(ApiResponse::internal)?
+    {
+        return Err(ApiResponse::not_found("延迟任务不存在"));
+    }
+    for server_id in affected {
+        state.push_agent_config(&server_id).await;
+    }
+    Ok(StatusCode::NO_CONTENT.into_response())
+}
+
+pub async fn alert_rules_get(State(state): State<Arc<AppState>>) -> Result<Response, ApiResponse> {
+    let rules = crate::db::queries::list_alert_rules(&state.db)
+        .await
+        .map_err(ApiResponse::internal)?;
+    Ok(Json(serde_json::json!({"rules": rules})).into_response())
+}
+
+pub async fn alert_rules_post(
+    State(state): State<Arc<AppState>>,
+    Json(input): Json<AlertRuleInput>,
+) -> Result<Response, ApiResponse> {
+    validate_alert_rule(&state, &input).await?;
+    if crate::db::queries::list_alert_rules(&state.db)
+        .await
+        .map_err(ApiResponse::internal)?
+        .len()
+        >= 20
+    {
+        return Err(ApiResponse::bad_request("最多可创建 20 条资源告警规则"));
+    }
+    let id = crate::db::queries::create_alert_rule(&state.db, &input)
+        .await
+        .map_err(ApiResponse::internal)?;
+    Ok((StatusCode::CREATED, Json(serde_json::json!({"id": id}))).into_response())
+}
+
+pub async fn alert_rule_patch(
+    State(state): State<Arc<AppState>>,
+    Path(id): Path<String>,
+    Json(input): Json<AlertRuleInput>,
+) -> Result<Response, ApiResponse> {
+    validate_id(&id)?;
+    validate_alert_rule(&state, &input).await?;
+    if !crate::db::queries::update_alert_rule(&state.db, &id, &input)
+        .await
+        .map_err(ApiResponse::internal)?
+    {
+        return Err(ApiResponse::not_found("告警规则不存在"));
+    }
+    Ok(StatusCode::NO_CONTENT.into_response())
+}
+
+pub async fn alert_rule_delete(
+    State(state): State<Arc<AppState>>,
+    Path(id): Path<String>,
+) -> Result<Response, ApiResponse> {
+    validate_id(&id)?;
+    if !crate::db::queries::delete_alert_rule(&state.db, &id)
+        .await
+        .map_err(ApiResponse::internal)?
+    {
+        return Err(ApiResponse::not_found("告警规则不存在"));
+    }
+    Ok(StatusCode::NO_CONTENT.into_response())
+}
+
+pub async fn telegram_get(State(state): State<Arc<AppState>>) -> Result<Response, ApiResponse> {
+    let telegram = crate::db::queries::telegram_settings(&state.db)
+        .await
+        .map_err(ApiResponse::internal)?;
+    Ok(Json(serde_json::json!({"telegram": telegram})).into_response())
+}
+
+pub async fn telegram_put(
+    State(state): State<Arc<AppState>>,
+    Json(input): Json<TelegramSettingsInput>,
+) -> Result<Response, ApiResponse> {
+    if input.bot_token.trim().is_empty()
+        || input.bot_token.len() > 512
+        || input.bot_token.chars().any(char::is_whitespace)
+        || input.chat_id.trim().is_empty()
+        || input.chat_id.len() > 128
+        || input.template.trim().is_empty()
+        || input.template.chars().count() > 4000
+        || input.message_thread_id.is_some_and(|value| value <= 0)
+    {
+        return Err(ApiResponse::bad_request("Telegram 配置格式无效"));
+    }
+    crate::db::queries::save_telegram_settings(&state.db, &input)
+        .await
+        .map_err(ApiResponse::internal)?;
+    Ok(StatusCode::NO_CONTENT.into_response())
+}
+
+pub async fn telegram_test(State(state): State<Arc<AppState>>) -> Result<Response, ApiResponse> {
+    crate::notify::test_telegram(&state.db, &state.http)
+        .await
+        .map_err(|error| ApiResponse::error(StatusCode::BAD_GATEWAY, error.to_string()))?;
+    Ok(StatusCode::NO_CONTENT.into_response())
+}
+
+pub async fn themes_get(State(state): State<Arc<AppState>>) -> Result<Response, ApiResponse> {
+    let settings = crate::db::load_settings(&state.db)
+        .await
+        .map_err(ApiResponse::internal)?;
+    let themes = crate::db::queries::list_themes(&state.db, &settings.active_theme_id)
+        .await
+        .map_err(ApiResponse::internal)?;
+    Ok(Json(serde_json::json!({"themes": themes})).into_response())
+}
+
+pub async fn themes_post(
+    State(state): State<Arc<AppState>>,
+    Json(input): Json<ThemeInput>,
+) -> Result<Response, ApiResponse> {
+    if !(1..=80).contains(&input.name.trim().chars().count())
+        || input.description.trim().chars().count() > 300
+    {
+        return Err(ApiResponse::bad_request("主题名称或说明无效"));
+    }
+    let resolved = crate::theme::resolve_url(&input.url)
+        .map_err(|error| ApiResponse::bad_request(error.to_string()))?;
+    let digest = Sha256::digest(resolved.source_url.as_bytes());
+    let id = format!("theme-{}", &hex::encode(digest)[..16]);
+    if crate::db::queries::theme_exists(&state.db, &id)
+        .await
+        .map_err(ApiResponse::internal)?
+    {
+        return Err(ApiResponse::conflict("该主题已添加"));
+    }
+    crate::theme::validate_remote(&state.http, &resolved.resolved_url)
+        .await
+        .map_err(|error| ApiResponse::unprocessable(error.to_string()))?;
+    let version = crate::theme::remote_version(&state.http, &resolved.resolved_url)
+        .await
+        .unwrap_or_default();
+    crate::db::queries::create_theme(
+        &state.db,
+        &id,
+        &ThemeInput {
+            url: resolved.source_url,
+            ..input
+        },
+        &resolved.resolved_url,
+        &version,
+    )
+    .await
+    .map_err(ApiResponse::internal)?;
+    Ok((StatusCode::CREATED, Json(serde_json::json!({"id": id}))).into_response())
+}
+
+pub async fn theme_activate(
+    State(state): State<Arc<AppState>>,
+    Path(id): Path<String>,
+) -> Result<Response, ApiResponse> {
+    validate_id(&id)?;
+    if id != crate::theme::BUILTIN_THEME_ID {
+        let url = crate::db::queries::theme_resolved_url(&state.db, &id)
+            .await
+            .map_err(ApiResponse::internal)?
+            .ok_or_else(|| ApiResponse::not_found("主题不存在"))?;
+        crate::theme::validate_remote(&state.http, &url)
+            .await
+            .map_err(|error| ApiResponse::unprocessable(error.to_string()))?;
+    }
+    if !crate::db::queries::set_active_theme(&state.db, &id)
+        .await
+        .map_err(ApiResponse::internal)?
+    {
+        return Err(ApiResponse::not_found("主题不存在"));
+    }
+    Ok(StatusCode::NO_CONTENT.into_response())
+}
+
+pub async fn theme_preview(
+    State(state): State<Arc<AppState>>,
+    Path(id): Path<String>,
+) -> Result<Response, ApiResponse> {
+    validate_id(&id)?;
+    if id == crate::theme::BUILTIN_THEME_ID
+        || !crate::db::queries::theme_exists(&state.db, &id)
+            .await
+            .map_err(ApiResponse::internal)?
+    {
+        return Err(ApiResponse::not_found("远程主题不存在"));
+    }
+    let proof = crate::db::queries::create_theme_preview(&state.db, &id)
+        .await
+        .map_err(ApiResponse::internal)?;
+    Ok(Json(serde_json::json!({
+        "preview_url": format!("/__theme-preview/{proof}/")
+    }))
+    .into_response())
+}
+
+pub async fn theme_delete(
+    State(state): State<Arc<AppState>>,
+    Path(id): Path<String>,
+) -> Result<Response, ApiResponse> {
+    validate_id(&id)?;
+    if id == crate::theme::BUILTIN_THEME_ID {
+        return Err(ApiResponse::bad_request("内置主题不能删除"));
+    }
+    if !crate::db::queries::delete_theme(&state.db, &id)
+        .await
+        .map_err(ApiResponse::internal)?
+    {
+        return Err(ApiResponse::not_found("主题不存在"));
+    }
+    Ok(StatusCode::NO_CONTENT.into_response())
+}
+
+pub async fn theme_settings(State(state): State<Arc<AppState>>) -> Result<Response, ApiResponse> {
+    let settings = crate::db::load_settings(&state.db)
+        .await
+        .map_err(ApiResponse::internal)?;
+    if settings.active_theme_id == crate::theme::BUILTIN_THEME_ID {
+        return Ok(Json(crate::theme::builtin_settings_schema()).into_response());
+    }
+    let url = crate::db::queries::theme_resolved_url(&state.db, &settings.active_theme_id)
+        .await
+        .map_err(ApiResponse::internal)?
+        .ok_or_else(|| ApiResponse::not_found("当前主题不存在"))?;
+    Ok(Json(
+        crate::theme::remote_settings_schema(&state.http, &url)
+            .await
+            .map_err(|error| ApiResponse::unprocessable(error.to_string()))?,
+    )
+    .into_response())
+}
+
+pub async fn exchange_refresh(State(state): State<Arc<AppState>>) -> Result<Response, ApiResponse> {
+    Ok(Json(
+        crate::exchange::refresh(&state.db, &state.http, true)
+            .await
+            .map_err(|error| ApiResponse::error(StatusCode::BAD_GATEWAY, error.to_string()))?,
+    )
+    .into_response())
+}
+
+pub async fn database_stats(State(state): State<Arc<AppState>>) -> Result<Response, ApiResponse> {
+    let threshold = crate::db::load_settings(&state.db)
+        .await
+        .map_err(ApiResponse::internal)?
+        .offline_threshold_seconds;
+    Ok(Json(
+        crate::db::queries::database_stats(&state.db, threshold)
+            .await
+            .map_err(ApiResponse::internal)?,
+    )
+    .into_response())
+}
+
+pub async fn history_delete(State(state): State<Arc<AppState>>) -> Result<Response, ApiResponse> {
+    crate::db::queries::clear_history(&state.db)
+        .await
+        .map_err(ApiResponse::internal)?;
+    Ok(StatusCode::NO_CONTENT.into_response())
+}
+
+fn validate_id(id: &str) -> Result<(), ApiResponse> {
+    if id.is_empty() || id.len() > 80 || id.contains('/') {
+        Err(ApiResponse::bad_request("ID 无效"))
+    } else {
+        Ok(())
+    }
+}
+
+fn validate_ids(ids: &[String]) -> Result<(), ApiResponse> {
+    if ids.is_empty()
+        || ids.len() > 500
+        || ids.iter().any(|id| validate_id(id).is_err())
+        || ids.iter().collect::<HashSet<_>>().len() != ids.len()
+    {
+        Err(ApiResponse::bad_request("节点列表无效"))
+    } else {
+        Ok(())
+    }
+}
+
+fn validate_server(input: &ServerInput) -> Result<(), &'static str> {
+    if !(1..=80).contains(&input.name.trim().chars().count()) {
+        return Err("节点名称长度应为 1 至 80 个字符");
+    }
+    if input.region.chars().count() > 16
+        || input.group_name.chars().count() > 40
+        || input.tags.chars().count() > 240
+    {
+        return Err("地区、分组或标签字段过长");
+    }
+    if input.traffic_limit < 0
+        || !matches!(
+            input.traffic_limit_type.as_str(),
+            "sum" | "max" | "min" | "up" | "down"
+        )
+    {
+        return Err("流量配置无效");
+    }
+    if !input.price.is_finite()
+        || !(-1.0..=1_000_000_000.0).contains(&input.price)
+        || !(0..=3650).contains(&input.billing_cycle)
+    {
+        return Err("价格或计费周期无效");
+    }
+    if input.currency.len() != 3
+        || !input
+            .currency
+            .chars()
+            .all(|value| value.is_ascii_alphabetic())
+    {
+        return Err("币种应为 3 位字母代码");
+    }
+    if !(1..=31).contains(&input.reset_day)
+        || !(15..=3600).contains(&input.report_interval)
+        || !(1..=60).contains(&input.collect_interval)
+        || input.collect_interval > input.report_interval
+        || (input.report_interval + input.collect_interval - 1) / input.collect_interval > 720
+    {
+        return Err("采样、上报或流量重置配置无效");
+    }
+    if input.network_interface.chars().count() > 160 || !valid_agent_mirror(&input.agent_mirror) {
+        return Err("网卡或 Agent 下载地址无效");
+    }
+    Ok(())
+}
+
+async fn validate_latency_task(
+    state: &AppState,
+    input: &LatencyTaskInput,
+) -> Result<(), ApiResponse> {
+    if !(1..=80).contains(&input.name.trim().chars().count())
+        || !matches!(input.task_type.as_str(), "tcp" | "icmp")
+        || !valid_ping_target(input.target.trim())
+        || !(30..=3600).contains(&input.interval_seconds)
+        || input.task_type == "tcp" && input.port.is_none_or(|port| !(1..=65535).contains(&port))
+        || input.task_type == "icmp" && input.port.is_some()
+    {
+        return Err(ApiResponse::bad_request("延迟任务格式无效"));
+    }
+    validate_ids_allow_empty(&input.server_ids)?;
+    let servers = crate::db::queries::all_server_ids(&state.db)
+        .await
+        .map_err(ApiResponse::internal)?;
+    if input.server_ids.iter().any(|id| !servers.contains(id)) {
+        return Err(ApiResponse::bad_request("延迟任务包含不存在的节点"));
+    }
+    Ok(())
+}
+
+async fn validate_alert_rule(state: &AppState, input: &AlertRuleInput) -> Result<(), ApiResponse> {
+    let maximum = if matches!(input.metric.as_str(), "cpu" | "memory" | "disk") {
+        100.0
+    } else {
+        1_000_000.0
+    };
+    if !(1..=80).contains(&input.name.trim().chars().count())
+        || !matches!(
+            input.metric.as_str(),
+            "cpu" | "memory" | "disk" | "net_in" | "net_out"
+        )
+        || !input.threshold.is_finite()
+        || input.threshold <= 0.0
+        || input.threshold > maximum
+        || !(1..=1440).contains(&input.duration_minutes)
+        || !matches!(input.aggregation.as_str(), "average" | "continuous")
+    {
+        return Err(ApiResponse::bad_request("告警规则格式无效"));
+    }
+    validate_ids_allow_empty(&input.server_ids)?;
+    let servers = crate::db::queries::all_server_ids(&state.db)
+        .await
+        .map_err(ApiResponse::internal)?;
+    if input.server_ids.iter().any(|id| !servers.contains(id)) {
+        return Err(ApiResponse::bad_request("告警规则包含不存在的节点"));
+    }
+    Ok(())
+}
+
+fn validate_ids_allow_empty(ids: &[String]) -> Result<(), ApiResponse> {
+    if ids.len() > 500
+        || ids.iter().any(|id| validate_id(id).is_err())
+        || ids.iter().collect::<HashSet<_>>().len() != ids.len()
+    {
+        Err(ApiResponse::bad_request("节点选择列表无效"))
+    } else {
+        Ok(())
+    }
+}
+
+async fn validate_settings(
+    state: &AppState,
+    current: &crate::db::Settings,
+    input: &SettingsInput,
+) -> Result<(), ApiResponse> {
+    if input
+        .site_name
+        .as_ref()
+        .is_some_and(|value| value.trim().is_empty() || value.chars().count() > 80)
+        || input
+            .site_description
+            .as_ref()
+            .is_some_and(|value| value.chars().count() > 240)
+        || input
+            .site_announcement
+            .as_ref()
+            .is_some_and(|value| value.chars().count() > 1000)
+        || input
+            .logo_url
+            .as_deref()
+            .is_some_and(|value| !valid_https_url(value))
+        || input
+            .background_url
+            .as_deref()
+            .is_some_and(|value| !valid_background_urls(value))
+        || input
+            .locale
+            .as_deref()
+            .is_some_and(|value| !matches!(value, "zh-CN" | "en"))
+        || input
+            .default_theme
+            .as_deref()
+            .is_some_and(|value| !matches!(value, "system" | "light" | "dark"))
+    {
+        return Err(ApiResponse::bad_request("站点设置格式无效"));
+    }
+    if input.admin_username.as_ref().is_some_and(|value| {
+        value.trim().is_empty()
+            || value.chars().count() > 64
+            || value.chars().any(char::is_whitespace)
+    }) {
+        return Err(ApiResponse::bad_request("管理员用户名格式无效"));
+    }
+    if input
+        .new_password
+        .as_ref()
+        .is_some_and(|value| !value.is_empty() && !(8..=128).contains(&value.chars().count()))
+        || input
+            .new_password
+            .as_ref()
+            .is_some_and(|value| !value.is_empty())
+            && input
+                .new_password_derived
+                .as_deref()
+                .is_none_or(|value| !crate::auth::valid_password_derived(value))
+    {
+        return Err(ApiResponse::bad_request("新密码格式无效"));
+    }
+    if input.theme_options.as_ref().is_some_and(|value| {
+        let Some(object) = value.as_object() else {
+            return true;
+        };
+        object.len() > 40 || value.to_string().len() > 12_000
+    }) {
+        return Err(ApiResponse::bad_request("主题设置格式无效"));
+    }
+    if let Some(id) = input.active_theme_id.as_deref() {
+        if id != crate::theme::BUILTIN_THEME_ID
+            && !crate::db::queries::theme_exists(&state.db, id)
+                .await
+                .map_err(ApiResponse::internal)?
+        {
+            return Err(ApiResponse::bad_request("活动主题不存在"));
+        }
+    }
+    let site_key = submitted_secret(
+        input.turnstile_site_key.as_deref(),
+        &current.turnstile_site_key,
+    );
+    let secret_key = submitted_secret(
+        input.turnstile_secret_key.as_deref(),
+        &current.turnstile_secret_key,
+    );
+    if site_key.is_empty() != secret_key.is_empty() {
+        return Err(ApiResponse::bad_request(
+            "Turnstile Site Key 和 Secret Key 必须同时填写或同时留空",
+        ));
+    }
+    Ok(())
+}
+
+fn submitted_secret<'a>(submitted: Option<&'a str>, current: &'a str) -> &'a str {
+    match submitted.map(str::trim) {
+        None | Some(SECRET_MASK) => current,
+        Some(value) => value,
+    }
+}
+
+fn valid_https_url(value: &str) -> bool {
+    let value = value.trim();
+    value.is_empty()
+        || value.len() <= 1000
+            && Url::parse(value).is_ok_and(|url| {
+                url.scheme() == "https"
+                    && url.host_str().is_some()
+                    && url.username().is_empty()
+                    && url.password().is_none()
+            })
+}
+
+fn valid_background_urls(value: &str) -> bool {
+    let parts = value.split('|').collect::<Vec<_>>();
+    value.trim().is_empty()
+        || parts.len() <= 2
+            && parts.iter().any(|part| !part.trim().is_empty())
+            && parts.iter().all(|part| valid_https_url(part))
+}
+
+fn valid_agent_mirror(value: &str) -> bool {
+    let value = value.trim().trim_end_matches('/');
+    if value.is_empty() {
+        return true;
+    }
+    Url::parse(value).is_ok_and(|url| {
+        url.host_str().is_some()
+            && url.username().is_empty()
+            && url.password().is_none()
+            && url.query().is_none()
+            && url.fragment().is_none()
+            && (url.scheme() == "https"
+                || url.scheme() == "http"
+                    && matches!(url.host_str(), Some("127.0.0.1" | "localhost" | "::1")))
+    })
+}
+
+fn valid_ping_target(value: &str) -> bool {
+    let labels = value.split('.').collect::<Vec<_>>();
+    if labels.len() == 4
+        && labels
+            .iter()
+            .all(|part| part.chars().all(|c| c.is_ascii_digit()))
+    {
+        return value.parse::<Ipv4Addr>().is_ok_and(|ip| {
+            let [a, b, c, _] = ip.octets();
+            !(a == 0
+                || a == 10
+                || a == 127
+                || a == 169 && b == 254
+                || a == 172 && (16..=31).contains(&b)
+                || a == 192 && b == 168
+                || a == 192 && b == 0 && (c == 0 || c == 2)
+                || a >= 224)
+        });
+    }
+    let lower = value.to_ascii_lowercase();
+    labels.len() >= 2
+        && !["local", "localhost", "internal", "lan", "localdomain"]
+            .iter()
+            .any(|suffix| lower == *suffix || lower.ends_with(&format!(".{suffix}")))
+        && labels.iter().all(|label| {
+            !label.is_empty()
+                && label.len() <= 63
+                && label
+                    .chars()
+                    .all(|character| character.is_ascii_alphanumeric() || character == '-')
+                && label
+                    .chars()
+                    .next()
+                    .is_some_and(|character| character.is_ascii_alphanumeric())
+                && label
+                    .chars()
+                    .last()
+                    .is_some_and(|character| character.is_ascii_alphanumeric())
+        })
+}
diff --git a/backend/src/routes/auth.rs b/backend/src/routes/auth.rs
new file mode 100644
index 0000000..135a4b9
--- /dev/null
+++ b/backend/src/routes/auth.rs
@@ -0,0 +1,238 @@
+use super::{
+    admin_cookie, bearer_or_cookie, forwarded_ip, hostname, request_is_secure, ApiResponse,
+};
+use crate::middleware::AuthenticatedUser;
+use crate::models::{
+    Enable2FaRequest, LoginRequest, TotpSetupResponse, TotpStatusResponse, TurnstileVerifyRequest,
+};
+use crate::AppState;
+use axum::extract::{Extension, State};
+use axum::http::{header::SET_COOKIE, HeaderMap, HeaderValue, StatusCode};
+use axum::response::{IntoResponse, Response};
+use axum::Json;
+use serde::Serialize;
+use std::sync::Arc;
+
+#[derive(Serialize)]
+struct LoginResponse {
+    token: String,
+}
+
+pub async fn login(
+    State(state): State<Arc<AppState>>,
+    headers: HeaderMap,
+    Json(input): Json<LoginRequest>,
+) -> Result<Response, ApiResponse> {
+    if input.username.trim().is_empty()
+        || input.password.is_empty()
+        || !crate::auth::valid_password_derived(&input.password_derived)
+    {
+        return Err(ApiResponse::bad_request("请输入用户名和密码"));
+    }
+    let settings = crate::db::load_settings(&state.db)
+        .await
+        .map_err(ApiResponse::internal)?;
+    let public = settings.public_config();
+    if public.turnstile_login_enabled {
+        let host = hostname(&headers).ok_or_else(|| ApiResponse::bad_request("请求主机名无效"))?;
+        let valid = crate::turnstile::verify(
+            &state.http,
+            &input.turnstile_token,
+            &settings.turnstile_secret_key,
+            forwarded_ip(&headers).as_deref(),
+            &host,
+            "admin_login",
+        )
+        .await;
+        if !valid {
+            return Err(ApiResponse::forbidden("Cloudflare 人机验证失败，请重试"));
+        }
+    }
+    if !secure_eq(input.username.trim(), settings.admin_username.trim())
+        || !crate::auth::verify_password(&input.password_derived, &settings.admin_password_hash)
+    {
+        return Err(ApiResponse::unauthorized("用户名或密码错误"));
+    }
+    if let Some((secret, enabled)) =
+        crate::db::queries::get_totp_secret(&state.db, &settings.admin_username)
+            .await
+            .map_err(ApiResponse::internal)?
+    {
+        if enabled {
+            if input.totp_code.trim().is_empty() {
+                return Err(ApiResponse::error(
+                    StatusCode::PRECONDITION_REQUIRED,
+                    "请输入两步验证码",
+                ));
+            }
+            if !crate::totp::verify_totp(&secret, input.totp_code.trim())
+                .map_err(ApiResponse::internal)?
+            {
+                return Err(ApiResponse::unauthorized("两步验证码错误"));
+            }
+        }
+    }
+    let token = crate::db::create_session(
+        &state.db,
+        &settings.admin_username,
+        state.config.session_ttl_hours,
+    )
+    .await
+    .map_err(ApiResponse::internal)?;
+    let mut response = Json(LoginResponse {
+        token: token.clone(),
+    })
+    .into_response();
+    response.headers_mut().append(
+        SET_COOKIE,
+        HeaderValue::from_str(&admin_cookie(
+            &token,
+            state.config.session_ttl_hours * 3600,
+            request_is_secure(&headers),
+        ))
+        .map_err(ApiResponse::internal)?,
+    );
+    Ok(response)
+}
+
+pub async fn logout(
+    State(state): State<Arc<AppState>>,
+    headers: HeaderMap,
+) -> Result<Response, ApiResponse> {
+    if let Some(token) = bearer_or_cookie(&headers) {
+        crate::db::revoke_session(&state.db, &token)
+            .await
+            .map_err(ApiResponse::internal)?;
+    }
+    let mut response = StatusCode::NO_CONTENT.into_response();
+    response.headers_mut().append(
+        SET_COOKIE,
+        HeaderValue::from_str(&admin_cookie("", 0, request_is_secure(&headers)))
+            .map_err(ApiResponse::internal)?,
+    );
+    Ok(response)
+}
+
+pub async fn verify_turnstile(
+    State(state): State<Arc<AppState>>,
+    headers: HeaderMap,
+    Json(input): Json<TurnstileVerifyRequest>,
+) -> Result<Response, ApiResponse> {
+    let settings = crate::db::load_settings(&state.db)
+        .await
+        .map_err(ApiResponse::internal)?;
+    if !settings.public_config().turnstile_enabled {
+        return Err(ApiResponse::bad_request("公开仪表盘未启用人机验证"));
+    }
+    let host = hostname(&headers).ok_or_else(|| ApiResponse::bad_request("请求主机名无效"))?;
+    if !crate::turnstile::verify(
+        &state.http,
+        &input.token,
+        &settings.turnstile_secret_key,
+        forwarded_ip(&headers).as_deref(),
+        &host,
+        "public_dashboard",
+    )
+    .await
+    {
+        return Err(ApiResponse::forbidden("Cloudflare 人机验证失败，请重试"));
+    }
+    let proof = crate::db::create_dashboard_proof(&state.db)
+        .await
+        .map_err(ApiResponse::internal)?;
+    let mut response = StatusCode::NO_CONTENT.into_response();
+    let secure = if request_is_secure(&headers) {
+        "; Secure"
+    } else {
+        ""
+    };
+    response.headers_mut().append(
+        SET_COOKIE,
+        HeaderValue::from_str(&format!(
+            "nodeflare_turnstile={proof}; Path=/; Max-Age=3600; HttpOnly; SameSite=Strict{secure}"
+        ))
+        .map_err(ApiResponse::internal)?,
+    );
+    Ok(response)
+}
+
+pub async fn get_2fa_status(
+    State(state): State<Arc<AppState>>,
+    Extension(user): Extension<AuthenticatedUser>,
+) -> Result<Json<TotpStatusResponse>, ApiResponse> {
+    let status = crate::db::queries::get_totp_secret(&state.db, &user.username)
+        .await
+        .map_err(ApiResponse::internal)?;
+    Ok(Json(TotpStatusResponse {
+        enabled: status.as_ref().is_some_and(|(_, enabled)| *enabled),
+        has_secret: status.is_some(),
+    }))
+}
+
+pub async fn setup_2fa(
+    State(state): State<Arc<AppState>>,
+    Extension(user): Extension<AuthenticatedUser>,
+) -> Result<Json<TotpSetupResponse>, ApiResponse> {
+    if crate::db::queries::get_totp_secret(&state.db, &user.username)
+        .await
+        .map_err(ApiResponse::internal)?
+        .is_some_and(|(_, enabled)| enabled)
+    {
+        return Err(ApiResponse::conflict(
+            "请先使用当前验证码禁用两步验证，再重新生成密钥",
+        ));
+    }
+    let secret = crate::totp::generate_secret();
+    let uri = crate::totp::generate_uri(&secret, "NodeFlare", &user.username);
+    crate::db::queries::save_totp_secret(&state.db, &user.username, &secret, false)
+        .await
+        .map_err(ApiResponse::internal)?;
+    Ok(Json(TotpSetupResponse {
+        secret,
+        uri,
+        enabled: false,
+    }))
+}
+
+pub async fn enable_2fa(
+    State(state): State<Arc<AppState>>,
+    Extension(user): Extension<AuthenticatedUser>,
+    Json(input): Json<Enable2FaRequest>,
+) -> Result<Response, ApiResponse> {
+    let (secret, _) = crate::db::queries::get_totp_secret(&state.db, &user.username)
+        .await
+        .map_err(ApiResponse::internal)?
+        .ok_or_else(|| ApiResponse::bad_request("请先生成两步验证密钥"))?;
+    if !crate::totp::verify_totp(&secret, input.totp_code.trim()).map_err(ApiResponse::internal)? {
+        return Err(ApiResponse::bad_request("两步验证码错误"));
+    }
+    crate::db::queries::set_totp_enabled(&state.db, &user.username, true)
+        .await
+        .map_err(ApiResponse::internal)?;
+    Ok(StatusCode::NO_CONTENT.into_response())
+}
+
+pub async fn disable_2fa(
+    State(state): State<Arc<AppState>>,
+    Extension(user): Extension<AuthenticatedUser>,
+    Json(input): Json<Enable2FaRequest>,
+) -> Result<Response, ApiResponse> {
+    let (secret, enabled) = crate::db::queries::get_totp_secret(&state.db, &user.username)
+        .await
+        .map_err(ApiResponse::internal)?
+        .ok_or_else(|| ApiResponse::bad_request("尚未配置两步验证"))?;
+    if !enabled {
+        return Ok(StatusCode::NO_CONTENT.into_response());
+    }
+    if !crate::totp::verify_totp(&secret, input.totp_code.trim()).map_err(ApiResponse::internal)? {
+        return Err(ApiResponse::bad_request("两步验证码错误"));
+    }
+    crate::db::queries::set_totp_enabled(&state.db, &user.username, false)
+        .await
+        .map_err(ApiResponse::internal)?;
+    Ok(StatusCode::NO_CONTENT.into_response())
+}
+
+fn secure_eq(left: &str, right: &str) -> bool {
+    crate::auth::token_hash(left) == crate::auth::token_hash(right)
+}
diff --git a/backend/src/routes/mod.rs b/backend/src/routes/mod.rs
new file mode 100644
index 0000000..55a53fb
--- /dev/null
+++ b/backend/src/routes/mod.rs
@@ -0,0 +1,120 @@
+pub mod admin;
+pub mod auth;
+pub mod public;
+pub mod remote;
+pub mod site;
+
+use crate::models::ApiError;
+use axum::http::{HeaderMap, StatusCode};
+use axum::response::{IntoResponse, Response};
+use axum::Json;
+
+#[derive(Debug)]
+pub struct ApiResponse {
+    status: StatusCode,
+    message: String,
+}
+
+impl ApiResponse {
+    pub fn error(status: StatusCode, message: impl Into<String>) -> Self {
+        Self {
+            status,
+            message: message.into(),
+        }
+    }
+
+    pub fn bad_request(message: impl Into<String>) -> Self {
+        Self::error(StatusCode::BAD_REQUEST, message)
+    }
+
+    pub fn unauthorized(message: impl Into<String>) -> Self {
+        Self::error(StatusCode::UNAUTHORIZED, message)
+    }
+
+    pub fn forbidden(message: impl Into<String>) -> Self {
+        Self::error(StatusCode::FORBIDDEN, message)
+    }
+
+    pub fn not_found(message: impl Into<String>) -> Self {
+        Self::error(StatusCode::NOT_FOUND, message)
+    }
+
+    pub fn conflict(message: impl Into<String>) -> Self {
+        Self::error(StatusCode::CONFLICT, message)
+    }
+
+    pub fn unprocessable(message: impl Into<String>) -> Self {
+        Self::error(StatusCode::UNPROCESSABLE_ENTITY, message)
+    }
+
+    pub fn internal(error: impl std::fmt::Display) -> Self {
+        tracing::error!(error = %error, "request failed");
+        Self::error(StatusCode::INTERNAL_SERVER_ERROR, "服务器内部错误")
+    }
+}
+
+impl IntoResponse for ApiResponse {
+    fn into_response(self) -> Response {
+        (self.status, Json(ApiError::new(self.message))).into_response()
+    }
+}
+
+pub fn bearer_or_cookie(headers: &HeaderMap) -> Option<String> {
+    if let Some(value) = headers
+        .get(axum::http::header::AUTHORIZATION)
+        .and_then(|value| value.to_str().ok())
+        .and_then(|value| value.strip_prefix("Bearer "))
+        .filter(|value| !value.is_empty())
+    {
+        return Some(value.to_string());
+    }
+    cookie(headers, "nodeflare_admin")
+}
+
+pub fn cookie(headers: &HeaderMap, name: &str) -> Option<String> {
+    headers
+        .get(axum::http::header::COOKIE)?
+        .to_str()
+        .ok()?
+        .split(';')
+        .map(str::trim)
+        .find_map(|pair| {
+            let (key, value) = pair.split_once('=')?;
+            (key == name).then(|| value.to_string())
+        })
+}
+
+pub fn hostname(headers: &HeaderMap) -> Option<String> {
+    headers
+        .get(axum::http::header::HOST)
+        .and_then(|value| value.to_str().ok())
+        .and_then(|value| value.split(':').next())
+        .filter(|value| !value.is_empty())
+        .map(str::to_string)
+}
+
+pub fn forwarded_ip(headers: &HeaderMap) -> Option<String> {
+    ["cf-connecting-ip", "x-real-ip"].iter().find_map(|name| {
+        headers
+            .get(*name)
+            .and_then(|value| value.to_str().ok())
+            .map(str::trim)
+            .filter(|value| value.parse::<std::net::IpAddr>().is_ok())
+            .map(str::to_string)
+    })
+}
+
+pub fn request_is_secure(headers: &HeaderMap) -> bool {
+    headers
+        .get("x-forwarded-proto")
+        .and_then(|value| value.to_str().ok())
+        .and_then(|value| value.split(',').next())
+        .is_some_and(|value| value.trim().eq_ignore_ascii_case("https"))
+}
+
+pub fn admin_cookie(token: &str, max_age: i64, secure: bool) -> String {
+    format!(
+        "nodeflare_admin={token}; Path=/; Max-Age={max_age}; HttpOnly; SameSite=Strict{}",
+        if secure { "; Secure" } else { "" }
+    )
+}
diff --git a/backend/src/routes/public.rs b/backend/src/routes/public.rs
new file mode 100644
index 0000000..5880778
--- /dev/null
+++ b/backend/src/routes/public.rs
@@ -0,0 +1,233 @@
+use super::{bearer_or_cookie, cookie, ApiResponse};
+use crate::db::Settings;
+use crate::models::{PublicConfig, WakeServersInput};
+use crate::AppState;
+use axum::extract::{Path, Query, State};
+use axum::http::{HeaderMap, StatusCode};
+use axum::response::{IntoResponse, Response};
+use axum::Json;
+use serde::Serialize;
+use std::collections::HashMap;
+use std::sync::Arc;
+
+#[derive(Serialize)]
+pub(crate) struct BootstrapResponse {
+    config: PublicConfig,
+    access: &'static str,
+    servers: Vec<serde_json::Value>,
+    exchange_rates: Option<crate::models::ExchangeRatesView>,
+}
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub enum DashboardAccess {
+    Ok,
+    Login,
+    Turnstile,
+}
+
+impl DashboardAccess {
+    fn name(self) -> &'static str {
+        match self {
+            Self::Ok => "ok",
+            Self::Login => "login",
+            Self::Turnstile => "turnstile",
+        }
+    }
+}
+
+pub async fn dashboard_access(
+    state: &AppState,
+    headers: &HeaderMap,
+    settings: &Settings,
+) -> Result<DashboardAccess, ApiResponse> {
+    let admin = if let Some(token) = bearer_or_cookie(headers) {
+        crate::db::session_username(&state.db, &token)
+            .await
+            .map_err(ApiResponse::internal)?
+            .is_some()
+    } else {
+        false
+    };
+    if admin {
+        return Ok(DashboardAccess::Ok);
+    }
+    let public = settings.public_config();
+    if public.turnstile_enabled {
+        let proof = cookie(headers, "nodeflare_turnstile").unwrap_or_default();
+        if !crate::db::valid_dashboard_proof(&state.db, &proof)
+            .await
+            .map_err(ApiResponse::internal)?
+        {
+            return Ok(DashboardAccess::Turnstile);
+        }
+    }
+    if !settings.public_dashboard {
+        return Ok(DashboardAccess::Login);
+    }
+    Ok(DashboardAccess::Ok)
+}
+
+pub async fn bootstrap(
+    State(state): State<Arc<AppState>>,
+    headers: HeaderMap,
+) -> Result<Json<BootstrapResponse>, ApiResponse> {
+    let settings = crate::db::load_settings(&state.db)
+        .await
+        .map_err(ApiResponse::internal)?;
+    let access = dashboard_access(&state, &headers, &settings).await?;
+    let config = settings.public_config();
+    if access != DashboardAccess::Ok {
+        return Ok(Json(BootstrapResponse {
+            config,
+            access: access.name(),
+            servers: Vec::new(),
+            exchange_rates: None,
+        }));
+    }
+    let servers = crate::db::queries::list_servers(&state.db, false)
+        .await
+        .map_err(ApiResponse::internal)?
+        .into_iter()
+        .map(public_server)
+        .collect();
+    let exchange_rates = crate::exchange::current(&state.db)
+        .await
+        .map_err(ApiResponse::internal)?;
+    Ok(Json(BootstrapResponse {
+        config,
+        access: access.name(),
+        servers,
+        exchange_rates: Some(exchange_rates),
+    }))
+}
+
+pub async fn config(State(state): State<Arc<AppState>>) -> Result<Json<PublicConfig>, ApiResponse> {
+    Ok(Json(
+        crate::db::load_settings(&state.db)
+            .await
+            .map_err(ApiResponse::internal)?
+            .public_config(),
+    ))
+}
+
+pub async fn servers(
+    State(state): State<Arc<AppState>>,
+    headers: HeaderMap,
+) -> Result<Response, ApiResponse> {
+    require_dashboard(&state, &headers).await?;
+    let servers = crate::db::queries::list_servers(&state.db, false)
+        .await
+        .map_err(ApiResponse::internal)?
+        .into_iter()
+        .map(public_server)
+        .collect::<Vec<_>>();
+    Ok(Json(serde_json::json!({"servers": servers})).into_response())
+}
+
+pub async fn history(
+    State(state): State<Arc<AppState>>,
+    headers: HeaderMap,
+    Path(server_id): Path<String>,
+    Query(query): Query<HashMap<String, String>>,
+) -> Result<Response, ApiResponse> {
+    require_dashboard(&state, &headers).await?;
+    require_public_server(&state, &server_id).await?;
+    let hours = query
+        .get("hours")
+        .and_then(|value| value.parse().ok())
+        .unwrap_or(24);
+    let points = crate::db::queries::history(&state.db, &server_id, hours)
+        .await
+        .map_err(ApiResponse::internal)?;
+    Ok(Json(serde_json::json!({"points": points})).into_response())
+}
+
+pub async fn latency_history(
+    State(state): State<Arc<AppState>>,
+    headers: HeaderMap,
+    Path(server_id): Path<String>,
+    Query(query): Query<HashMap<String, String>>,
+) -> Result<Response, ApiResponse> {
+    require_dashboard(&state, &headers).await?;
+    require_public_server(&state, &server_id).await?;
+    let hours = query
+        .get("hours")
+        .and_then(|value| value.parse().ok())
+        .unwrap_or(24);
+    let (tasks, points) = crate::db::queries::latency_history(&state.db, &server_id, hours)
+        .await
+        .map_err(ApiResponse::internal)?;
+    Ok(Json(serde_json::json!({"tasks": tasks, "points": points})).into_response())
+}
+
+pub async fn exchange_rates(State(state): State<Arc<AppState>>) -> Result<Response, ApiResponse> {
+    Ok(Json(
+        crate::exchange::current(&state.db)
+            .await
+            .map_err(ApiResponse::internal)?,
+    )
+    .into_response())
+}
+
+pub async fn wake_servers(
+    State(state): State<Arc<AppState>>,
+    headers: HeaderMap,
+    Json(input): Json<WakeServersInput>,
+) -> Result<Response, ApiResponse> {
+    require_dashboard(&state, &headers).await?;
+    if input.server_ids.len() > 500 {
+        return Err(ApiResponse::bad_request("服务器列表过长"));
+    }
+    for server_id in input.server_ids {
+        state.wake_agent(&server_id).await;
+    }
+    Ok(StatusCode::NO_CONTENT.into_response())
+}
+
+async fn require_dashboard(state: &AppState, headers: &HeaderMap) -> Result<(), ApiResponse> {
+    let settings = crate::db::load_settings(&state.db)
+        .await
+        .map_err(ApiResponse::internal)?;
+    match dashboard_access(state, headers, &settings).await? {
+        DashboardAccess::Ok => Ok(()),
+        DashboardAccess::Login => Err(ApiResponse::unauthorized("此仪表盘需要登录后访问")),
+        DashboardAccess::Turnstile => Err(ApiResponse::forbidden("请先完成人机验证")),
+    }
+}
+
+async fn require_public_server(state: &AppState, server_id: &str) -> Result<(), ApiResponse> {
+    if server_id.is_empty()
+        || server_id.len() > 80
+        || server_id.contains('/')
+        || !crate::db::queries::public_server_exists(&state.db, server_id)
+            .await
+            .map_err(ApiResponse::internal)?
+    {
+        return Err(ApiResponse::not_found("节点不存在"));
+    }
+    Ok(())
+}
+
+fn public_server(server: crate::models::ServerView) -> serde_json::Value {
+    let mut value = serde_json::to_value(server).unwrap_or_else(|_| serde_json::json!({}));
+    if let Some(object) = value.as_object_mut() {
+        for key in [
+            "hidden",
+            "last_ip",
+            "ip_v4",
+            "ip_v6",
+            "network_interface",
+            "reset_day",
+            "report_interval",
+            "collect_interval",
+            "rx_correction",
+            "tx_correction",
+            "agent_mirror",
+            "offline_notify_disabled",
+            "auto_update",
+        ] {
+            object.remove(key);
+        }
+    }
+    value
+}
diff --git a/backend/src/routes/remote.rs b/backend/src/routes/remote.rs
new file mode 100644
index 0000000..32dba90
--- /dev/null
+++ b/backend/src/routes/remote.rs
@@ -0,0 +1,89 @@
+use super::ApiResponse;
+use crate::middleware::AuthenticatedUser;
+use crate::models::CreateRemoteTaskRequest;
+use crate::AppState;
+use axum::extract::{Extension, Path, State};
+use axum::http::StatusCode;
+use axum::response::{IntoResponse, Response};
+use axum::Json;
+use std::sync::Arc;
+
+pub async fn create_task(
+    State(state): State<Arc<AppState>>,
+    Extension(user): Extension<AuthenticatedUser>,
+    Json(input): Json<CreateRemoteTaskRequest>,
+) -> Result<Response, ApiResponse> {
+    let command = input.command.trim();
+    let script = input.script.trim();
+    if input.server_id.is_empty()
+        || input.server_id.len() > 80
+        || command.is_empty() == script.is_empty()
+        || command.len() > 16_384
+        || script.len() > 256 * 1024
+    {
+        return Err(ApiResponse::bad_request(
+            "请选择一个节点，并且只填写命令或脚本中的一项",
+        ));
+    }
+    if let Some((secret, enabled)) = crate::db::queries::get_totp_secret(&state.db, &user.username)
+        .await
+        .map_err(ApiResponse::internal)?
+    {
+        if enabled
+            && (input.totp_code.trim().is_empty()
+                || !crate::totp::verify_totp(&secret, input.totp_code.trim())
+                    .map_err(ApiResponse::internal)?)
+        {
+            return Err(ApiResponse::unauthorized("远程执行需要有效的两步验证码"));
+        }
+    }
+    if !crate::db::queries::all_server_ids(&state.db)
+        .await
+        .map_err(ApiResponse::internal)?
+        .contains(&input.server_id)
+    {
+        return Err(ApiResponse::not_found("节点不存在"));
+    }
+    let task = crate::db::queries::create_remote_task(
+        &state.db,
+        &input.server_id,
+        command,
+        script,
+        &user.username,
+    )
+    .await
+    .map_err(ApiResponse::internal)?;
+    if state.send_remote_task(&task).await {
+        crate::db::queries::mark_remote_task_sent(&state.db, &task.id, &task.server_id)
+            .await
+            .map_err(ApiResponse::internal)?;
+    }
+    Ok((
+        StatusCode::CREATED,
+        Json(serde_json::json!({"task_id": task.id})),
+    )
+        .into_response())
+}
+
+pub async fn get_task(
+    State(state): State<Arc<AppState>>,
+    Path(id): Path<String>,
+) -> Result<Response, ApiResponse> {
+    let task = crate::db::queries::remote_task(&state.db, &id)
+        .await
+        .map_err(ApiResponse::internal)?
+        .ok_or_else(|| ApiResponse::not_found("任务不存在"))?;
+    Ok(Json(task).into_response())
+}
+
+pub async fn get_server_tasks(
+    State(state): State<Arc<AppState>>,
+    Path(server_id): Path<String>,
+) -> Result<Response, ApiResponse> {
+    Ok(Json(
+        crate::db::queries::server_remote_tasks(&state.db, &server_id, 50)
+            .await
+            .map_err(ApiResponse::internal)?,
+    )
+    .into_response())
+}
diff --git a/backend/src/routes/site.rs b/backend/src/routes/site.rs
new file mode 100644
index 0000000..d6b48e0
--- /dev/null
+++ b/backend/src/routes/site.rs
@@ -0,0 +1,156 @@
+use crate::routes::ApiResponse;
+use crate::AppState;
+use axum::body::Body;
+use axum::extract::{OriginalUri, State};
+use axum::http::{header, HeaderValue, StatusCode};
+use axum::response::{IntoResponse, Response};
+use std::path::{Component, Path, PathBuf};
+use std::sync::Arc;
+
+pub async fn handle(State(state): State<Arc<AppState>>, OriginalUri(uri): OriginalUri) -> Response {
+    let path = uri.path();
+    if path.starts_with("/api/") {
+        return ApiResponse::not_found("接口不存在").into_response();
+    }
+    if matches!(path, "/admin" | "/admin/" | "/admin/index.html") {
+        return local_file(&state.config.admin_frontend_dir, "admin.html", false).await;
+    }
+    if let Some(relative) = path.strip_prefix("/admin-assets/") {
+        return local_file(&state.config.admin_frontend_dir, relative, true).await;
+    }
+    if let Some(relative) = path.strip_prefix("/agent/") {
+        return local_file(&state.config.agent_dir, relative, true).await;
+    }
+    if let Some(preview) = path.strip_prefix("/__theme-preview/") {
+        let (token, relative) = preview.split_once('/').unwrap_or((preview, ""));
+        let base = match crate::db::queries::theme_preview_url(&state.db, token).await {
+            Ok(Some(base)) => base,
+            Ok(None) => return (StatusCode::FORBIDDEN, "主题预览链接已失效").into_response(),
+            Err(error) => return ApiResponse::internal(error).into_response(),
+        };
+        return remote_theme(
+            &state,
+            &base,
+            relative,
+            &format!("/__theme-preview/{token}"),
+        )
+        .await;
+    }
+    if let Some(relative) = path.strip_prefix("/__theme-active/") {
+        let settings = match crate::db::load_settings(&state.db).await {
+            Ok(settings) => settings,
+            Err(error) => return ApiResponse::internal(error).into_response(),
+        };
+        let base = match crate::db::queries::theme_resolved_url(
+            &state.db,
+            &settings.active_theme_id,
+        )
+        .await
+        {
+            Ok(Some(base)) => base,
+            _ => return StatusCode::NOT_FOUND.into_response(),
+        };
+        return remote_theme(&state, &base, relative, "/__theme-active").await;
+    }
+
+    let settings = match crate::db::load_settings(&state.db).await {
+        Ok(settings) => settings,
+        Err(error) => return ApiResponse::internal(error).into_response(),
+    };
+    if settings.active_theme_id != crate::theme::BUILTIN_THEME_ID {
+        if let Ok(Some(base)) =
+            crate::db::queries::theme_resolved_url(&state.db, &settings.active_theme_id).await
+        {
+            let relative = path.trim_start_matches('/');
+            return remote_theme(&state, &base, relative, "/__theme-active").await;
+        }
+    }
+
+    let relative = path.trim_start_matches('/');
+    if relative.is_empty() || path.starts_with("/instance/") {
+        return local_file(&state.config.frontend_dir, "index.html", false).await;
+    }
+    let response = local_file(&state.config.frontend_dir, relative, true).await;
+    if response.status() == StatusCode::NOT_FOUND
+        && !relative.rsplit('/').next().is_some_and(|p| p.contains('.'))
+    {
+        local_file(&state.config.frontend_dir, "index.html", false).await
+    } else {
+        response
+    }
+}
+
+async fn remote_theme(state: &AppState, base: &str, relative: &str, prefix: &str) -> Response {
+    match crate::theme::fetch_theme_path(&state.http, base, relative, prefix).await {
+        Ok((body, content_type)) => response(body, &content_type, true),
+        Err(error) => {
+            tracing::warn!(%error, path = relative, "remote theme asset failed");
+            StatusCode::NOT_FOUND.into_response()
+        }
+    }
+}
+
+async fn local_file(root: &Path, relative: &str, cache: bool) -> Response {
+    let Some(path) = safe_join(root, relative) else {
+        return StatusCode::NOT_FOUND.into_response();
+    };
+    match tokio::fs::read(&path).await {
+        Ok(body) => response(body, content_type(&path), cache),
+        Err(_) => StatusCode::NOT_FOUND.into_response(),
+    }
+}
+
+fn safe_join(root: &Path, relative: &str) -> Option<PathBuf> {
+    let relative = Path::new(relative);
+    if relative.is_absolute()
+        || relative
+            .components()
+            .any(|component| !matches!(component, Component::Normal(_)))
+    {
+        return None;
+    }
+    Some(root.join(relative))
+}
+
+fn response(body: Vec<u8>, content_type: &str, cache: bool) -> Response {
+    let mut response = Response::new(Body::from(body));
+    if let Ok(value) = HeaderValue::from_str(content_type) {
+        response.headers_mut().insert(header::CONTENT_TYPE, value);
+    }
+    response.headers_mut().insert(
+        header::X_CONTENT_TYPE_OPTIONS,
+        HeaderValue::from_static("nosniff"),
+    );
+    response.headers_mut().insert(
+        header::CACHE_CONTROL,
+        HeaderValue::from_static(if cache {
+            "public, max-age=3600"
+        } else {
+            "no-cache"
+        }),
+    );
+    response
+}
+
+fn content_type(path: &Path) -> &'static str {
+    match path
+        .extension()
+        .and_then(|value| value.to_str())
+        .unwrap_or("")
+    {
+        "html" => "text/html; charset=utf-8",
+        "js" | "mjs" => "application/javascript; charset=utf-8",
+        "css" => "text/css; charset=utf-8",
+        "json" => "application/json; charset=utf-8",
+        "svg" => "image/svg+xml",
+        "png" => "image/png",
+        "jpg" | "jpeg" => "image/jpeg",
+        "webp" => "image/webp",
+        "ico" => "image/x-icon",
+        "woff2" => "font/woff2",
+        "wasm" => "application/wasm",
+        "sh" => "text/x-shellscript; charset=utf-8",
+        "ps1" => "text/plain; charset=utf-8",
+        _ => "application/octet-stream",
+    }
+}
diff --git a/backend/src/theme.rs b/backend/src/theme.rs
new file mode 100644
index 0000000..fc58cfe
--- /dev/null
+++ b/backend/src/theme.rs
@@ -0,0 +1,290 @@
+use anyhow::{Context, Result};
+use serde_json::Value;
+use std::collections::HashSet;
+use std::time::Duration;
+use url::Url;
+
+pub const BUILTIN_THEME_ID: &str = "builtin-nodeflare-glass";
+const INDEX_MAX_BYTES: usize = 4 * 1024 * 1024;
+const ASSET_MAX_BYTES: usize = 16 * 1024 * 1024;
+const SETTINGS_MAX_BYTES: usize = 64 * 1024;
+
+#[derive(Debug, Clone)]
+pub struct ResolvedTheme {
+    pub source_url: String,
+    pub resolved_url: String,
+}
+
+pub fn resolve_url(value: &str) -> Result<ResolvedTheme> {
+    let source_url = normalize_url(value).context("主题 URL 仅支持 GitHub 仓库地址")?;
+    let parsed = Url::parse(&source_url)?;
+    let parts = parsed
+        .path()
+        .trim_matches('/')
+        .split('/')
+        .filter(|part| !part.is_empty())
+        .collect::<Vec<_>>();
+    let suffix = if parts.len() > 4 {
+        format!("/{}", parts[4..].join("/"))
+    } else {
+        String::new()
+    };
+    Ok(ResolvedTheme {
+        source_url,
+        resolved_url: format!(
+            "https://raw.githubusercontent.com/{}/{}/{}{}",
+            parts[0], parts[1], parts[3], suffix
+        ),
+    })
+}
+
+pub fn normalize_url(value: &str) -> Option<String> {
+    let raw = value.trim();
+    if !(12..=2048).contains(&raw.len()) || raw.contains('\\') {
+        return None;
+    }
+    let parsed = Url::parse(raw).ok()?;
+    if parsed.scheme() != "https"
+        || parsed.host_str() != Some("github.com")
+        || parsed.port().is_some()
+        || !parsed.username().is_empty()
+        || parsed.password().is_some()
+        || parsed.query().is_some()
+        || parsed.fragment().is_some()
+    {
+        return None;
+    }
+    let mut parts = parsed
+        .path()
+        .trim_matches('/')
+        .split('/')
+        .filter(|part| !part.is_empty())
+        .collect::<Vec<_>>();
+    if parts.len() == 2 {
+        parts.extend(["tree", "main"]);
+    }
+    if parts.len() < 4
+        || parts[2] != "tree"
+        || parts.iter().any(|part| {
+            matches!(*part, "." | "..")
+                || part.is_empty()
+                || !part
+                    .chars()
+                    .all(|character| character.is_ascii_alphanumeric() || ".-_".contains(character))
+        })
+    {
+        return None;
+    }
+    Some(format!("https://github.com/{}", parts.join("/")))
+}
+
+pub async fn validate_remote(client: &reqwest::Client, base: &str) -> Result<()> {
+    let (body, _) = fetch_remote(client, base, "index.html", INDEX_MAX_BYTES).await?;
+    let html = String::from_utf8(body).context("主题 index.html 不是 UTF-8 文本")?;
+    if html.trim().is_empty() {
+        anyhow::bail!("主题 index.html 为空");
+    }
+    Ok(())
+}
+
+pub async fn remote_settings_schema(client: &reqwest::Client, base: &str) -> Result<Value> {
+    let response = client
+        .get(remote_url(base, "theme.json")?)
+        .timeout(Duration::from_secs(10))
+        .send()
+        .await?;
+    if response.status() == reqwest::StatusCode::NOT_FOUND {
+        return Ok(serde_json::json!({"schema": 1, "source": "remote", "settings": []}));
+    }
+    let response = response.error_for_status()?;
+    let body = bounded_body(response, SETTINGS_MAX_BYTES).await?;
+    let value: Value = serde_json::from_slice(&body)?;
+    validate_settings_schema(value).context("主题 theme.json 设置格式无效")
+}
+
+pub async fn remote_version(client: &reqwest::Client, base: &str) -> Option<String> {
+    let value = remote_settings_schema(client, base).await.ok()?;
+    let version = value.get("version")?.as_str()?.trim();
+    (!version.is_empty()
+        && version.len() <= 40
+        && version
+            .chars()
+            .all(|character| character.is_ascii_alphanumeric() || ".-_+ ".contains(character)))
+    .then(|| version.to_string())
+}
+
+pub async fn fetch_theme_path(
+    client: &reqwest::Client,
+    base: &str,
+    relative: &str,
+    prefix: &str,
+) -> Result<(Vec<u8>, String)> {
+    let relative = sanitize_relative(relative)?;
+    let target = if relative.is_empty() {
+        "index.html"
+    } else {
+        relative
+    };
+    let limit = if target == "index.html" {
+        INDEX_MAX_BYTES
+    } else {
+        ASSET_MAX_BYTES
+    };
+    let (body, content_type) = fetch_remote(client, base, target, limit).await?;
+    if target == "index.html" {
+        let html = String::from_utf8(body)?;
+        return Ok((rewrite_index(&html, prefix).into_bytes(), content_type));
+    }
+    Ok((body, content_type))
+}
+
+fn sanitize_relative(value: &str) -> Result<&str> {
+    let relative = value.trim_start_matches('/');
+    if relative.len() > 1024
+        || relative.contains('\\')
+        || relative.contains('%')
+        || relative.contains('?')
+        || relative.contains('#')
+        || relative
+            .split('/')
+            .any(|part| part == "." || part == ".." || part.is_empty() && !relative.is_empty())
+    {
+        anyhow::bail!("主题资源路径无效");
+    }
+    Ok(relative)
+}
+
+async fn fetch_remote(
+    client: &reqwest::Client,
+    base: &str,
+    relative: &str,
+    limit: usize,
+) -> Result<(Vec<u8>, String)> {
+    let response = client
+        .get(remote_url(base, relative)?)
+        .timeout(Duration::from_secs(10))
+        .send()
+        .await?
+        .error_for_status()?;
+    let content_type = response
+        .headers()
+        .get(reqwest::header::CONTENT_TYPE)
+        .and_then(|value| value.to_str().ok())
+        .unwrap_or("application/octet-stream")
+        .to_string();
+    Ok((bounded_body(response, limit).await?, content_type))
+}
+
+async fn bounded_body(response: reqwest::Response, limit: usize) -> Result<Vec<u8>> {
+    if response
+        .content_length()
+        .is_some_and(|length| length > limit as u64)
+    {
+        anyhow::bail!("远程主题资源过大");
+    }
+    let body = response.bytes().await?;
+    if body.len() > limit {
+        anyhow::bail!("远程主题资源过大");
+    }
+    Ok(body.to_vec())
+}
+
+fn remote_url(base: &str, relative: &str) -> Result<Url> {
+    let base = Url::parse(&format!("{}/", base.trim_end_matches('/')))?;
+    if base.scheme() != "https" || base.host_str() != Some("raw.githubusercontent.com") {
+        anyhow::bail!("主题资源地址无效");
+    }
+    let target = base.join(relative)?;
+    if target.origin() != base.origin() || !target.path().starts_with(base.path()) {
+        anyhow::bail!("主题资源越界");
+    }
+    Ok(target)
+}
+
+fn rewrite_index(html: &str, prefix: &str) -> String {
+    let asset_prefix = format!("{}/assets/", prefix.trim_end_matches('/'));
+    html.replace("\"/assets/", &format!("\"{asset_prefix}"))
+        .replace("'/assets/", &format!("'{asset_prefix}"))
+}
+
+pub fn builtin_settings_schema() -> Value {
+    let currencies = [
+        "CNY", "USD", "HKD", "EUR", "GBP", "JPY", "RUB", "CHF", "INR", "VND", "THB", "CAD",
+    ];
+    serde_json::json!({
+        "schema": 1,
+        "source": "builtin",
+        "settings": [
+            {
+                "key": "assetCurrency", "label": "资产折算币种", "type": "select",
+                "default": "CNY",
+                "options": currencies.iter().map(|currency| serde_json::json!({
+                    "label": currency, "value": currency
+                })).collect::<Vec<_>>()
+            },
+            {"key": "enableBlur", "label": "启用毛玻璃效果", "type": "toggle", "default": true},
+            {"key": "showOnline", "label": "总览显示在线节点", "type": "toggle", "default": true},
+            {"key": "showCarrierLatency", "label": "节点卡片分线路显示延迟", "type": "toggle", "default": false},
+            {"key": "telecomLatencyTask", "label": "电信线路任务名称", "type": "text", "default": "", "placeholder": "留空时按任务名称自动匹配"},
+            {"key": "mobileLatencyTask", "label": "移动线路任务名称", "type": "text", "default": "", "placeholder": "留空时按任务名称自动匹配"},
+            {"key": "unicomLatencyTask", "label": "联通线路任务名称", "type": "text", "default": "", "placeholder": "留空时按任务名称自动匹配"}
+        ]
+    })
+}
+
+fn validate_settings_schema(value: Value) -> Option<Value> {
+    let object = value.as_object()?;
+    if object.get("schema")?.as_u64()? != 1 {
+        return None;
+    }
+    let fields = object.get("settings")?.as_array()?;
+    if fields.len() > 40 {
+        return None;
+    }
+    let allowed = [
+        "text", "textarea", "url", "color", "select", "toggle", "number",
+    ];
+    let mut keys = HashSet::new();
+    for field in fields {
+        let field = field.as_object()?;
+        let key = field.get("key")?.as_str()?;
+        let label = field.get("label")?.as_str()?;
+        let kind = field.get("type")?.as_str()?;
+        if key.is_empty()
+            || key.len() > 64
+            || label.is_empty()
+            || label.chars().count() > 80
+            || !allowed.contains(&kind)
+            || !key
+                .chars()
+                .all(|character| character.is_ascii_alphanumeric() || "_-".contains(character))
+            || !keys.insert(key)
+        {
+            return None;
+        }
+        if kind == "select" && !field.get("options").is_some_and(Value::is_array) {
+            return None;
+        }
+    }
+    let mut result = value;
+    result
+        .as_object_mut()?
+        .insert("source".to_string(), Value::String("remote".to_string()));
+    Some(result)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn accepts_github_theme_urls() {
+        assert_eq!(
+            resolve_url("https://github.com/acme/theme/tree/main/dist")
+                .unwrap()
+                .resolved_url,
+            "https://raw.githubusercontent.com/acme/theme/main/dist"
+        );
+        assert!(resolve_url("https://example.com/theme").is_err());
+    }
+}
diff --git a/backend/src/totp.rs b/backend/src/totp.rs
new file mode 100644
index 0000000..029789b
--- /dev/null
+++ b/backend/src/totp.rs
@@ -0,0 +1,89 @@
+use anyhow::{anyhow, Result};
+use rand::Rng;
+use totp_lite::{totp_custom, Sha1};
+
+const TOTP_DIGITS: u32 = 6;
+const TOTP_STEP: u64 = 30;
+
+/// 生成一个新的 TOTP secret（base32 编码）
+pub fn generate_secret() -> String {
+    let mut rng = rand::thread_rng();
+    let secret: [u8; 20] = rng.gen();
+    data_encoding::BASE32_NOPAD.encode(&secret)
+}
+
+/// 生成 TOTP URI（用于显示二维码）
+pub fn generate_uri(secret: &str, issuer: &str, account_name: &str) -> String {
+    let issuer = url::form_urlencoded::byte_serialize(issuer.as_bytes()).collect::<String>();
+    let account = url::form_urlencoded::byte_serialize(account_name.as_bytes()).collect::<String>();
+    format!(
+        "otpauth://totp/{issuer}:{account}?secret={secret}&issuer={issuer}&digits={TOTP_DIGITS}&period={TOTP_STEP}",
+    )
+}
+
+/// 验证 TOTP 代码（允许前后一个时间窗口的误差）
+pub fn verify_totp(secret: &str, code: &str) -> Result<bool> {
+    let secret_bytes = data_encoding::BASE32_NOPAD
+        .decode(secret.as_bytes())
+        .map_err(|e| anyhow!("Invalid base32 secret: {}", e))?;
+
+    let now = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)?
+        .as_secs();
+
+    // 检查当前时间窗口以及前后各一个窗口（总共 3 个窗口，容忍 ±30 秒）
+    for offset in [-1i64, 0, 1] {
+        let time = ((now as i64 + offset * TOTP_STEP as i64) / TOTP_STEP as i64) as u64;
+        let expected = totp_custom::<Sha1>(TOTP_STEP, TOTP_DIGITS, &secret_bytes, time);
+        if code == expected {
+            return Ok(true);
+        }
+    }
+
+    Ok(false)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_generate_secret() {
+        let secret = generate_secret();
+        assert!(!secret.is_empty());
+        // Base32 字符集
+        assert!(secret
+            .chars()
+            .all(|c| "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567".contains(c)));
+    }
+
+    #[test]
+    fn test_generate_uri() {
+        let secret = "JBSWY3DPEHPK3PXP";
+        let uri = generate_uri(secret, "NodeFlare", "admin");
+        assert!(uri.starts_with("otpauth://totp/"));
+        assert!(uri.contains("secret=JBSWY3DPEHPK3PXP"));
+        assert!(uri.contains("digits=6"));
+        assert!(uri.contains("period=30"));
+    }
+
+    #[test]
+    fn test_verify_totp() {
+        let secret = "JBSWY3DPEHPK3PXP";
+        let secret_bytes = data_encoding::BASE32_NOPAD
+            .decode(secret.as_bytes())
+            .unwrap();
+
+        let now = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .unwrap()
+            .as_secs();
+        let time = now / TOTP_STEP;
+
+        let code = totp_custom::<Sha1>(TOTP_STEP, TOTP_DIGITS, &secret_bytes, time);
+        assert!(verify_totp(secret, &code).unwrap());
+
+        // 错误的代码
+        assert!(!verify_totp(secret, "000000").unwrap());
+    }
+}
diff --git a/backend/src/turnstile.rs b/backend/src/turnstile.rs
new file mode 100644
index 0000000..efe948a
--- /dev/null
+++ b/backend/src/turnstile.rs
@@ -0,0 +1,52 @@
+use serde::{Deserialize, Serialize};
+use std::time::Duration;
+
+#[derive(Serialize)]
+struct VerifyRequest<'a> {
+    secret: &'a str,
+    response: &'a str,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    remoteip: Option<&'a str>,
+}
+
+#[derive(Deserialize)]
+struct VerifyResponse {
+    success: bool,
+    #[serde(default)]
+    hostname: String,
+    #[serde(default)]
+    action: String,
+}
+
+pub async fn verify(
+    client: &reqwest::Client,
+    token: &str,
+    secret: &str,
+    remote_ip: Option<&str>,
+    hostname: &str,
+    expected_action: &str,
+) -> bool {
+    if token.is_empty() || secret.is_empty() {
+        return false;
+    }
+    let result = client
+        .post("https://challenges.cloudflare.com/turnstile/v0/siteverify")
+        .timeout(Duration::from_secs(8))
+        .form(&VerifyRequest {
+            secret,
+            response: token,
+            remoteip: remote_ip,
+        })
+        .send()
+        .await
+        .and_then(reqwest::Response::error_for_status);
+    let Ok(response) = result else {
+        return false;
+    };
+    let Ok(result) = response.json::<VerifyResponse>().await else {
+        return false;
+    };
+    result.success
+        && (result.hostname.is_empty() || result.hostname.eq_ignore_ascii_case(hostname))
+        && (result.action.is_empty() || result.action == expected_action)
+}
diff --git a/backend/src/websocket/agent.rs b/backend/src/websocket/agent.rs
new file mode 100644
index 0000000..9e5bce2
--- /dev/null
+++ b/backend/src/websocket/agent.rs
@@ -0,0 +1,351 @@
+use super::{AgentCommand, AgentConnection, DashboardEvent};
+use crate::db::queries::{AgentIdentity, PersistResult};
+use crate::models::{AgentReport, RemoteTaskInfo};
+use crate::routes::{forwarded_ip, ApiResponse};
+use crate::AppState;
+use axum::extract::ws::{Message, WebSocket, WebSocketUpgrade};
+use axum::extract::{ConnectInfo, State};
+use axum::http::HeaderMap;
+use axum::response::{IntoResponse, Response};
+use futures_util::{SinkExt, StreamExt};
+use serde::Deserialize;
+use std::net::SocketAddr;
+use std::sync::Arc;
+use tokio::sync::mpsc;
+
+const MAX_AGENT_MESSAGE_BYTES: usize = 2 * 1024 * 1024;
+const MAX_TASK_RESULT_BYTES: usize = 1024 * 1024;
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct UpdateMessage {
+    #[serde(rename = "type")]
+    _message_type: String,
+    #[serde(rename = "batchId")]
+    batch_id: String,
+    samples: Vec<AgentReport>,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct TaskResultMessage {
+    #[serde(rename = "type")]
+    _message_type: String,
+    task_id: String,
+    status: String,
+    result: String,
+    exit_code: Option<i64>,
+}
+
+pub async fn handle(
+    ws: WebSocketUpgrade,
+    State(state): State<Arc<AppState>>,
+    ConnectInfo(peer): ConnectInfo<SocketAddr>,
+    headers: HeaderMap,
+) -> Response {
+    let token = headers
+        .get(axum::http::header::AUTHORIZATION)
+        .and_then(|value| value.to_str().ok())
+        .and_then(|value| value.strip_prefix("Bearer "))
+        .unwrap_or("");
+    if token.is_empty() || token.len() > 512 {
+        return ApiResponse::unauthorized("Agent Token 无效").into_response();
+    }
+    let identity = match crate::db::queries::agent_identity(&state.db, token).await {
+        Ok(Some(identity)) => identity,
+        Ok(None) => return ApiResponse::unauthorized("Agent Token 无效").into_response(),
+        Err(error) => return ApiResponse::internal(error).into_response(),
+    };
+    let remote_ip = forwarded_ip(&headers).unwrap_or_else(|| peer.ip().to_string());
+    ws.max_message_size(MAX_AGENT_MESSAGE_BYTES)
+        .max_frame_size(MAX_AGENT_MESSAGE_BYTES)
+        .on_upgrade(move |socket| run(socket, state, identity, remote_ip))
+}
+
+async fn run(socket: WebSocket, state: Arc<AppState>, identity: AgentIdentity, remote_ip: String) {
+    let connection_id = uuid::Uuid::new_v4().to_string();
+    let (mut websocket_tx, mut websocket_rx) = socket.split();
+    let (outbound_tx, mut outbound_rx) = mpsc::unbounded_channel::<AgentCommand>();
+    state.agents.write().await.insert(
+        identity.server_id.clone(),
+        AgentConnection {
+            connection_id: connection_id.clone(),
+            sender: outbound_tx.clone(),
+            report_interval: identity.report_interval,
+            collect_interval: identity.collect_interval,
+        },
+    );
+    tracing::info!(server_id = %identity.server_id, remote_ip, "Agent connected");
+
+    if let Some(config) = crate::db::queries::agent_config(&state.db, &identity.server_id)
+        .await
+        .ok()
+        .flatten()
+    {
+        let _ = outbound_tx.send(AgentCommand::Text(
+            serde_json::json!({"type": "config", "ts": crate::db::now(), "config": config})
+                .to_string(),
+        ));
+    }
+    if let Ok(tasks) =
+        crate::db::queries::pending_remote_tasks(&state.db, &identity.server_id).await
+    {
+        for task in tasks {
+            if send_task(&outbound_tx, &task) {
+                let _ = crate::db::queries::mark_remote_task_sent(
+                    &state.db,
+                    &task.id,
+                    &identity.server_id,
+                )
+                .await;
+            }
+        }
+    }
+
+    let writer = tokio::spawn(async move {
+        while let Some(command) = outbound_rx.recv().await {
+            match command {
+                AgentCommand::Text(text) => {
+                    if websocket_tx.send(Message::Text(text)).await.is_err() {
+                        break;
+                    }
+                }
+                AgentCommand::Pong(payload) => {
+                    if websocket_tx.send(Message::Pong(payload)).await.is_err() {
+                        break;
+                    }
+                }
+                AgentCommand::Close => {
+                    let _ = websocket_tx.send(Message::Close(None)).await;
+                    break;
+                }
+            }
+        }
+    });
+
+    while let Some(message) = websocket_rx.next().await {
+        match message {
+            Ok(Message::Text(text)) if text.len() <= MAX_AGENT_MESSAGE_BYTES => {
+                handle_text(&state, &identity, &remote_ip, &outbound_tx, &text).await;
+            }
+            Ok(Message::Ping(payload)) => {
+                let _ = outbound_tx.send(AgentCommand::Pong(payload));
+            }
+            Ok(Message::Close(_)) | Err(_) => break,
+            _ => {}
+        }
+    }
+    writer.abort();
+    let mut agents = state.agents.write().await;
+    if agents
+        .get(&identity.server_id)
+        .is_some_and(|connection| connection.connection_id == connection_id)
+    {
+        agents.remove(&identity.server_id);
+    }
+    tracing::info!(server_id = %identity.server_id, "Agent disconnected");
+}
+
+async fn handle_text(
+    state: &Arc<AppState>,
+    identity: &AgentIdentity,
+    remote_ip: &str,
+    outbound: &mpsc::UnboundedSender<AgentCommand>,
+    text: &str,
+) {
+    let Ok(value) = serde_json::from_str::<serde_json::Value>(text) else {
+        return;
+    };
+    match value.get("type").and_then(serde_json::Value::as_str) {
+        Some("update") => {
+            let Ok(update) = serde_json::from_value::<UpdateMessage>(value) else {
+                send_persistence_error(outbound, 0);
+                return;
+            };
+            if !valid_batch_id(&update.batch_id) {
+                send_persistence_error(outbound, 0);
+                return;
+            }
+            match crate::db::queries::save_agent_batch(
+                &state.db,
+                identity,
+                &update.batch_id,
+                &update.samples,
+                remote_ip,
+            )
+            .await
+            {
+                Ok(result) => {
+                    send_ack(outbound, identity, &result);
+                    if !result.reports.is_empty() {
+                        broadcast_reports(state, identity, &result.reports);
+                        let state = Arc::clone(state);
+                        let server_id = identity.server_id.clone();
+                        tokio::spawn(async move {
+                            let settings = match crate::db::load_settings(&state.db).await {
+                                Ok(settings) => settings,
+                                Err(error) => {
+                                    tracing::error!(%error, "failed to load alert settings");
+                                    return;
+                                }
+                            };
+                            let server_name = crate::db::queries::list_servers(&state.db, true)
+                                .await
+                                .ok()
+                                .and_then(|servers| {
+                                    servers
+                                        .into_iter()
+                                        .find(|server| server.id == server_id)
+                                        .map(|server| server.name)
+                                })
+                                .unwrap_or_else(|| server_id.clone());
+                            if let Err(error) = crate::notify::evaluate_resource_alerts(
+                                &state.db,
+                                &state.http,
+                                &settings,
+                                &server_id,
+                                &server_name,
+                            )
+                            .await
+                            {
+                                tracing::error!(%error, server_id, "resource alert evaluation failed");
+                            }
+                        });
+                    }
+                }
+                Err(error) => {
+                    tracing::error!(%error, server_id = %identity.server_id, "Agent batch persistence failed");
+                    send_persistence_error(outbound, 0);
+                }
+            }
+        }
+        Some("task_result") => {
+            let Ok(result) = serde_json::from_value::<TaskResultMessage>(value) else {
+                return;
+            };
+            if result.task_id.is_empty()
+                || result.task_id.len() > 80
+                || !matches!(result.status.as_str(), "success" | "failed")
+                || result.result.len() > MAX_TASK_RESULT_BYTES
+            {
+                return;
+            }
+            if let Err(error) = crate::db::queries::update_remote_task_result(
+                &state.db,
+                &identity.server_id,
+                &result.task_id,
+                &result.status,
+                &result.result,
+                result.exit_code,
+            )
+            .await
+            {
+                tracing::error!(%error, server_id = %identity.server_id, "task result persistence failed");
+            }
+        }
+        _ => {}
+    }
+}
+
+fn send_task(outbound: &mpsc::UnboundedSender<AgentCommand>, task: &RemoteTaskInfo) -> bool {
+    outbound
+        .send(AgentCommand::Text(
+            serde_json::json!({
+                "type": "remote_task",
+                "task_id": task.id,
+                "command": task.command,
+                "script": task.script,
+            })
+            .to_string(),
+        ))
+        .is_ok()
+}
+
+fn send_ack(
+    outbound: &mpsc::UnboundedSender<AgentCommand>,
+    identity: &AgentIdentity,
+    result: &PersistResult,
+) {
+    let report_interval = identity.report_interval.clamp(15, 3600) * 1000;
+    let live_interval = identity.collect_interval.clamp(1, 60) * 1000;
+    let _ = outbound.send(AgentCommand::Text(
+        serde_json::json!({
+            "type": "ack",
+            "ts": crate::db::now(),
+            "persisted": true,
+            "persistenceError": false,
+            "persistedThroughTs": result.persisted_through,
+            "nextD1WriteAfterMs": report_interval,
+            "nextWssReportAfterMs": live_interval,
+            "realtimeHint": false,
+        })
+        .to_string(),
+    ));
+}
+
+fn send_persistence_error(outbound: &mpsc::UnboundedSender<AgentCommand>, persisted: i64) {
+    let _ = outbound.send(AgentCommand::Text(
+        serde_json::json!({
+            "type": "ack",
+            "ts": crate::db::now(),
+            "persisted": false,
+            "persistenceError": true,
+            "persistedThroughTs": persisted,
+            "nextD1WriteAfterMs": 5000,
+            "nextWssReportAfterMs": 5000,
+            "realtimeHint": false,
+        })
+        .to_string(),
+    ));
+}
+
+fn broadcast_reports(state: &AppState, identity: &AgentIdentity, reports: &[AgentReport]) {
+    if identity.hidden {
+        return;
+    }
+    let samples = reports
+        .iter()
+        .map(|report| {
+            let mut data = serde_json::to_value(report).unwrap_or_else(|_| serde_json::json!({}));
+            if let Some(object) = data.as_object_mut() {
+                for key in [
+                    "timestamp",
+                    "cpu_model",
+                    "os",
+                    "kernel",
+                    "arch",
+                    "virtualization",
+                    "gpu_model",
+                    "agent_version",
+                    "ip_v4",
+                    "ip_v6",
+                ] {
+                    object.remove(key);
+                }
+            }
+            serde_json::json!({"ts": report.timestamp, "data": data})
+        })
+        .collect::<Vec<_>>();
+    let payload = serde_json::json!({
+        "type": "batchUpdate",
+        "ts": crate::db::now(),
+        "updates": [{"serverId": identity.server_id, "samples": samples}],
+    })
+    .to_string();
+    let _ = state.dashboard_tx.send(DashboardEvent {
+        server_id: identity.server_id.clone(),
+        payload,
+    });
+}
+
+fn valid_batch_id(value: &str) -> bool {
+    !value.is_empty()
+        && value.len() <= 128
+        && value
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_' | b'.' | b':'))
+}
+
+pub fn queue_remote_task(connection: &AgentConnection, task: &RemoteTaskInfo) -> bool {
+    send_task(&connection.sender, task)
+}
diff --git a/backend/src/websocket/dashboard.rs b/backend/src/websocket/dashboard.rs
new file mode 100644
index 0000000..ed9218c
--- /dev/null
+++ b/backend/src/websocket/dashboard.rs
@@ -0,0 +1,74 @@
+use crate::routes::public::{dashboard_access, DashboardAccess};
+use crate::routes::ApiResponse;
+use crate::AppState;
+use axum::extract::ws::{Message, WebSocket, WebSocketUpgrade};
+use axum::extract::{Query, State};
+use axum::http::HeaderMap;
+use axum::response::{IntoResponse, Response};
+use futures_util::{SinkExt, StreamExt};
+use serde::Deserialize;
+use std::sync::Arc;
+
+#[derive(Deserialize)]
+pub struct DashboardQuery {
+    server_id: Option<String>,
+}
+
+pub async fn handle(
+    ws: WebSocketUpgrade,
+    State(state): State<Arc<AppState>>,
+    Query(query): Query<DashboardQuery>,
+    headers: HeaderMap,
+) -> Response {
+    let settings = match crate::db::load_settings(&state.db).await {
+        Ok(settings) => settings,
+        Err(error) => return ApiResponse::internal(error).into_response(),
+    };
+    match dashboard_access(&state, &headers, &settings).await {
+        Ok(DashboardAccess::Ok) => {}
+        Ok(DashboardAccess::Login) => {
+            return ApiResponse::unauthorized("此仪表盘需要登录后访问").into_response()
+        }
+        Ok(DashboardAccess::Turnstile) => {
+            return ApiResponse::forbidden("请先完成人机验证").into_response()
+        }
+        Err(error) => return error.into_response(),
+    }
+    let server_id = query
+        .server_id
+        .filter(|value| !value.is_empty() && value.len() <= 80 && !value.contains('/'));
+    ws.on_upgrade(move |socket| run(socket, state, server_id))
+}
+
+async fn run(socket: WebSocket, state: Arc<AppState>, server_id: Option<String>) {
+    let (mut sender, mut receiver) = socket.split();
+    let mut updates = state.dashboard_tx.subscribe();
+    loop {
+        tokio::select! {
+            update = updates.recv() => match update {
+                Ok(update) if server_id.as_ref().is_none_or(|id| id == &update.server_id) => {
+                    if sender.send(Message::Text(update.payload)).await.is_err() {
+                        break;
+                    }
+                }
+                Ok(_) => {}
+                Err(tokio::sync::broadcast::error::RecvError::Lagged(_)) => {}
+                Err(tokio::sync::broadcast::error::RecvError::Closed) => break,
+            },
+            incoming = receiver.next() => match incoming {
+                Some(Ok(Message::Text(text))) if text == "ping" => {
+                    if sender.send(Message::Text("pong".to_string())).await.is_err() {
+                        break;
+                    }
+                }
+                Some(Ok(Message::Ping(payload))) => {
+                    if sender.send(Message::Pong(payload)).await.is_err() {
+                        break;
+                    }
+                }
+                Some(Ok(Message::Close(_))) | Some(Err(_)) | None => break,
+                _ => {}
+            }
+        }
+    }
+}
diff --git a/backend/src/websocket/mod.rs b/backend/src/websocket/mod.rs
new file mode 100644
index 0000000..106d4d9
--- /dev/null
+++ b/backend/src/websocket/mod.rs
@@ -0,0 +1,25 @@
+pub mod agent;
+pub mod dashboard;
+
+use tokio::sync::mpsc;
+
+#[derive(Clone)]
+pub struct AgentConnection {
+    pub connection_id: String,
+    pub sender: mpsc::UnboundedSender<AgentCommand>,
+    pub report_interval: i64,
+    pub collect_interval: i64,
+}
+
+#[derive(Debug)]
+pub enum AgentCommand {
+    Text(String),
+    Pong(Vec<u8>),
+    Close,
+}
+
+#[derive(Debug, Clone)]
+pub struct DashboardEvent {
+    pub server_id: String,
+    pub payload: String,
+}
diff --git a/build.rs b/build.rs
deleted file mode 100644
index 44e5e57..0000000
--- a/build.rs
+++ /dev/null
@@ -1,41 +0,0 @@
-use std::{env, fs, path::PathBuf};
-
-fn main() {
-    let root = PathBuf::from(env::var("CARGO_MANIFEST_DIR").expect("manifest directory"));
-    let dist = root.join("frontend/admin-dist");
-    let out = PathBuf::from(env::var("OUT_DIR").expect("build output directory"));
-    let release = env::var("PROFILE").as_deref() == Ok("release");
-
-    println!("cargo:rerun-if-changed=frontend/admin-dist/admin.html");
-    println!("cargo:rerun-if-changed=frontend/admin-dist/admin.js");
-    println!("cargo:rerun-if-changed=frontend/admin-dist/admin.css");
-    println!("cargo:rerun-if-env-changed=NODEFLARE_VERSION");
-
-    let files = [
-        (
-            "admin.html",
-            b"<!doctype html><meta charset=\"utf-8\"><title>Admin unavailable</title><p>Run the frontend admin build first.</p>".as_slice(),
-        ),
-        (
-            "admin.js",
-            b"console.error('Run the frontend admin build first.');".as_slice(),
-        ),
-        (
-            "admin.css",
-            b"body{font-family:system-ui,sans-serif}".as_slice(),
-        ),
-    ];
-
-    for (name, fallback) in files {
-        let source = dist.join(name);
-        let body = match fs::read(&source) {
-            Ok(body) => body,
-            Err(error) if release => panic!(
-                "missing embedded admin asset {} ({error}); run `bun run build:frontend` before the release Worker build",
-                source.display()
-            ),
-            Err(_) => fallback.to_vec(),
-        };
-        fs::write(out.join(name), body).expect("write embedded admin asset");
-    }
-}
diff --git a/bun.lock b/bun.lock
index 9bc4b6b..feb2624 100644
--- a/bun.lock
+++ b/bun.lock
@@ -5,7 +5,6 @@
     "": {
       "name": "nodeflare",
       "devDependencies": {
-        "wrangler": "^4.127.0",
         "ws": "^8.21.3",
       },
     },
@@ -32,144 +31,8 @@
     "nanoid": "3.3.18",
   },
   "packages": {
-    "@cloudflare/kv-asset-handler": ["@cloudflare/kv-asset-handler@0.5.0", "", {}, "sha512-jxQYkj8dSIzc0cD6cMMNdOc1UVjqSqu8BZdor5s8cGjW2I8BjODt/kWPVdY+u9zj3ms75Q5qaZgnxUad83+eAg=="],
-
-    "@cloudflare/unenv-preset": ["@cloudflare/unenv-preset@2.16.1", "", { "peerDependencies": { "unenv": "2.0.0-rc.24", "workerd": ">1.20260305.0 <2.0.0-0" }, "optionalPeers": ["workerd"] }, "sha512-ECxObrMfyTl5bhQf/lZCXwo5G6xX9IAUo+nDMKK4SZ8m4Jvvxp52vilxyySSWh2YTZz8+HQ07qGH/2rEom1vDw=="],
-
-    "@cloudflare/workerd-darwin-64": ["@cloudflare/workerd-darwin-64@1.20260826.1", "", { "os": "darwin", "cpu": "x64" }, "sha512-8UsGGY8ZUiYHOWdsxBlNsGmaHBGArVwJ3CM4nWpfBhthjjYe4M/OqrTpqKF7NNWb63qQiv1d8Z+Z6/hmUqNKIQ=="],
-
-    "@cloudflare/workerd-darwin-arm64": ["@cloudflare/workerd-darwin-arm64@1.20260826.1", "", { "os": "darwin", "cpu": "arm64" }, "sha512-0bLqVQYsQ3v3FdYGmzh23vi9fJeYTBx19o4LUySIsRcgBggGSlR39ml162vTXvZzUISOjVW2qfL7Y+SMrrfXmQ=="],
-
-    "@cloudflare/workerd-linux-64": ["@cloudflare/workerd-linux-64@1.20260826.1", "", { "os": "linux", "cpu": "x64" }, "sha512-DTC0yWzybX4gUH5Q1pJo3UwEQjp0Gmz0Q71I+39xT9SXBesX5QndOIQv45yHQ86Z84EzK2WwaENdlpmDSvJKmw=="],
-
-    "@cloudflare/workerd-linux-arm64": ["@cloudflare/workerd-linux-arm64@1.20260826.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-PFerWi+DP2Ckc6eATAS4dhotBt8IeXJjTzIgy18H+uqsswlXc7A8HsnAunHL9v/7/BjCgq46iMo2g4iUAsEpDw=="],
-
-    "@cloudflare/workerd-windows-64": ["@cloudflare/workerd-windows-64@1.20260826.1", "", { "os": "win32", "cpu": "x64" }, "sha512-X26hulrG2MSSfpRmjZbCq98LNaZnrRqbmGcgo7g1U/U0nJ5npYruPm3fAyZ2y6VDr5CmQo9BLCahxP8VB/QR6A=="],
-
-    "@cspotcode/source-map-support": ["@cspotcode/source-map-support@0.8.1", "", { "dependencies": { "@jridgewell/trace-mapping": "0.3.9" } }, "sha512-IchNf6dN4tHoMFIn/7OE8LWZ19Y6q/67Bmf6vnGREv8RSbBVb9LPJxEcnwrcwX6ixSvaiGoomAUvu4YSxXrVgw=="],
-
-    "@emnapi/runtime": ["@emnapi/runtime@1.11.3", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-Xz4Tpyki7XyrpbUK1jR1AhdAdaXyhhY4lZ3neLodmhpuWfy2PAQN5B46sAiU4liOXGLkHypn/qU+jvfWSCYYLA=="],
-
-    "@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.28.1", "", { "os": "aix", "cpu": "ppc64" }, "sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ=="],
-
-    "@esbuild/android-arm": ["@esbuild/android-arm@0.28.1", "", { "os": "android", "cpu": "arm" }, "sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ=="],
-
-    "@esbuild/android-arm64": ["@esbuild/android-arm64@0.28.1", "", { "os": "android", "cpu": "arm64" }, "sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg=="],
-
-    "@esbuild/android-x64": ["@esbuild/android-x64@0.28.1", "", { "os": "android", "cpu": "x64" }, "sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng=="],
-
-    "@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.28.1", "", { "os": "darwin", "cpu": "arm64" }, "sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q=="],
-
-    "@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.28.1", "", { "os": "darwin", "cpu": "x64" }, "sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ=="],
-
-    "@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.28.1", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw=="],
-
-    "@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.28.1", "", { "os": "freebsd", "cpu": "x64" }, "sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ=="],
-
-    "@esbuild/linux-arm": ["@esbuild/linux-arm@0.28.1", "", { "os": "linux", "cpu": "arm" }, "sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ=="],
-
-    "@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.28.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g=="],
-
-    "@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.28.1", "", { "os": "linux", "cpu": "ia32" }, "sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w=="],
-
-    "@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.28.1", "", { "os": "linux", "cpu": "none" }, "sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg=="],
-
-    "@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.28.1", "", { "os": "linux", "cpu": "none" }, "sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ=="],
-
-    "@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.28.1", "", { "os": "linux", "cpu": "ppc64" }, "sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ=="],
-
-    "@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.28.1", "", { "os": "linux", "cpu": "none" }, "sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ=="],
-
-    "@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.28.1", "", { "os": "linux", "cpu": "s390x" }, "sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag=="],
-
-    "@esbuild/linux-x64": ["@esbuild/linux-x64@0.28.1", "", { "os": "linux", "cpu": "x64" }, "sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA=="],
-
-    "@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.28.1", "", { "os": "none", "cpu": "arm64" }, "sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw=="],
-
-    "@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.28.1", "", { "os": "none", "cpu": "x64" }, "sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg=="],
-
-    "@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.28.1", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q=="],
-
-    "@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.28.1", "", { "os": "openbsd", "cpu": "x64" }, "sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw=="],
-
-    "@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.28.1", "", { "os": "none", "cpu": "arm64" }, "sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg=="],
-
-    "@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.28.1", "", { "os": "sunos", "cpu": "x64" }, "sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ=="],
-
-    "@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.28.1", "", { "os": "win32", "cpu": "arm64" }, "sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA=="],
-
-    "@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.28.1", "", { "os": "win32", "cpu": "ia32" }, "sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg=="],
-
-    "@esbuild/win32-x64": ["@esbuild/win32-x64@0.28.1", "", { "os": "win32", "cpu": "x64" }, "sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A=="],
-
-    "@img/colour": ["@img/colour@1.1.0", "", {}, "sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ=="],
-
-    "@img/sharp-darwin-arm64": ["@img/sharp-darwin-arm64@0.35.2", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-arm64": "1.3.1" }, "os": "darwin", "cpu": "arm64" }, "sha512-eEieHsMksAW4IiO5NzauESRl2D2qz3J/kwUxUrSfV06A93eEaRfMpHXyUb1mAqrR7i8U9A0GRqE9pjn6u1Jjpg=="],
-
-    "@img/sharp-darwin-x64": ["@img/sharp-darwin-x64@0.35.2", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-x64": "1.3.1" }, "os": "darwin", "cpu": "x64" }, "sha512-BaktuGPCeHJMARpodR8jK4uKiZrPAy9WrfQW0sdI37clracq8Bp01AYS3SZgi5FS/y5twa9t4+LIuuxQjqRrWw=="],
-
-    "@img/sharp-freebsd-wasm32": ["@img/sharp-freebsd-wasm32@0.35.2", "", { "dependencies": { "@img/sharp-wasm32": "0.35.2" }, "os": "freebsd" }, "sha512-YoAxdnd8hPUkvLHd3bWY+YA8nw3xM/RyRopYucNsWHVSan8NLVM3X2volsfoRDcXdUJPg6tXahSd7HXPK7lRnw=="],
-
-    "@img/sharp-libvips-darwin-arm64": ["@img/sharp-libvips-darwin-arm64@1.3.1", "", { "os": "darwin", "cpu": "arm64" }, "sha512-4V/M3roRMTYjiwZY9IOVQOE8OyeCxFAkYmyZDrZl51uOKjibm3oeEJ4WAmLxutAfzFbC9jqUiPs2gbnGflH+7g=="],
-
-    "@img/sharp-libvips-darwin-x64": ["@img/sharp-libvips-darwin-x64@1.3.1", "", { "os": "darwin", "cpu": "x64" }, "sha512-c0/DxItpJv2+dGhgycJBBgotdqruGYDvA79drdh0MD1dFpy7JzJ/PlXwi1H4rFf0eTy8tgbI91aHDnZIceY3jQ=="],
-
-    "@img/sharp-libvips-linux-arm": ["@img/sharp-libvips-linux-arm@1.3.1", "", { "os": "linux", "cpu": "arm" }, "sha512-aGGy9aWzXgHBG7HNyQPWorZthlp7+x6fDRoPAQbGO3ThcttuTyKIx3NuSHb6zb4gBNq6/yNn9f1cy9nFKS/Vmg=="],
-
-    "@img/sharp-libvips-linux-arm64": ["@img/sharp-libvips-linux-arm64@1.3.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-JznefmcK9j1JKPz8AkQDh89kjojubyfOasWBPKfzMIhPwsgDy9evpE/naJTXXXmghS1iFwR8u/kTwh/I2/+GCw=="],
-
-    "@img/sharp-libvips-linux-ppc64": ["@img/sharp-libvips-linux-ppc64@1.3.1", "", { "os": "linux", "cpu": "ppc64" }, "sha512-1EkwGNCZk6iWNCMWqrvdJ+r1j0PT1zIz60CNPhYnJlK/zyeWqlsPZIe+ocBVqPF8k/Ssee/NCk+tE9Ryrko6ng=="],
-
-    "@img/sharp-libvips-linux-riscv64": ["@img/sharp-libvips-linux-riscv64@1.3.1", "", { "os": "linux", "cpu": "none" }, "sha512-Ilays+w2bXdnxzxtQdmXR62u8o8GYa3eL4+Gr+1KiE4xperMZUslRaVPJwwPkzlHEjGfXAfRVAa/7CYCtSqsBw=="],
-
-    "@img/sharp-libvips-linux-s390x": ["@img/sharp-libvips-linux-s390x@1.3.1", "", { "os": "linux", "cpu": "s390x" }, "sha512-VfBwVHQTbRoj4XlpA/KLZ7ltgMpz+4WSejFzQ+GnoImjo1PtEJ59QB2qR1xQEeRPYIkNrPIm2L4cICMvz4C2ew=="],
-
-    "@img/sharp-libvips-linux-x64": ["@img/sharp-libvips-linux-x64@1.3.1", "", { "os": "linux", "cpu": "x64" }, "sha512-+c8ukgwU62DS54nCAjw7keOfHUkmr0B5QHEdcOqRnodF/MNXJbVI8Eopoj4B/0H8Asr65I+A4Amrn7a85/md6A=="],
-
-    "@img/sharp-libvips-linuxmusl-arm64": ["@img/sharp-libvips-linuxmusl-arm64@1.3.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-qlKb/pwbkAi1WMsJrYHk7CuDrd12s27U2QnRhFYUoJNrRCmkosMTttuRFat/DDB3IlDm5qE1TJgZ4JDnHX8Ldw=="],
-
-    "@img/sharp-libvips-linuxmusl-x64": ["@img/sharp-libvips-linuxmusl-x64@1.3.1", "", { "os": "linux", "cpu": "x64" }, "sha512-yO21HwoUVLN8Qa+/SBjQLMYwBWAVJjeGPNe+hc0OUeMeifEtJqu5a1c4HayE1nNpDih9y3/KkoltfkDodmKAlg=="],
-
-    "@img/sharp-linux-arm": ["@img/sharp-linux-arm@0.35.2", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm": "1.3.1" }, "os": "linux", "cpu": "arm" }, "sha512-SE4kzF2mepn6z+6E7L6lsV8FzuLL6IPQdyX8ZiwROAG/G8td+hP/m7FsFPwidtrF19gvajuC9l6TxAVcsA4S7A=="],
-
-    "@img/sharp-linux-arm64": ["@img/sharp-linux-arm64@0.35.2", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm64": "1.3.1" }, "os": "linux", "cpu": "arm64" }, "sha512-af12Pnd0ZGu2HfP8NayB0kk6eC/lrfbQE6HlR4jD+34wdJ1Vw9TF6TMn6ZvffT+WgqVsl0hRbmNvz2u/23VmwA=="],
-
-    "@img/sharp-linux-ppc64": ["@img/sharp-linux-ppc64@0.35.2", "", { "optionalDependencies": { "@img/sharp-libvips-linux-ppc64": "1.3.1" }, "os": "linux", "cpu": "ppc64" }, "sha512-hYSBm7zcNtDCozCxQHYZJiu63b/bXsgRZuOxCIBZsStMM9Vap47iFHdbX4kCvQsblPB/k+clhELpdQJHQLSHvg=="],
-
-    "@img/sharp-linux-riscv64": ["@img/sharp-linux-riscv64@0.35.2", "", { "optionalDependencies": { "@img/sharp-libvips-linux-riscv64": "1.3.1" }, "os": "linux", "cpu": "none" }, "sha512-qQt0Kc13+Hoan/Awq/qMSQw3L+RI1NCRPgD5cUJ/1WSSmIoysLOc72jlRM3E0OHN9Yr313jgeQ2T+zW+F03QFA=="],
-
-    "@img/sharp-linux-s390x": ["@img/sharp-linux-s390x@0.35.2", "", { "optionalDependencies": { "@img/sharp-libvips-linux-s390x": "1.3.1" }, "os": "linux", "cpu": "s390x" }, "sha512-E4fLLfRPzDLlEeDaTzI98OFLcv++WL5ChLLMwPoVd0CIoZQqupBSNbOisPL5am9XsbQ9T84+iiMpUvbFtkunbA=="],
-
-    "@img/sharp-linux-x64": ["@img/sharp-linux-x64@0.35.2", "", { "optionalDependencies": { "@img/sharp-libvips-linux-x64": "1.3.1" }, "os": "linux", "cpu": "x64" }, "sha512-gi0zFJJRLswfCZmHtJdikXPOc5u7qamSOS3NHedLqLd4W8Q0NqjdBr6TTRIgsfFjqfTsHFgdfvJ9LwqSgcHiAA=="],
-
-    "@img/sharp-linuxmusl-arm64": ["@img/sharp-linuxmusl-arm64@0.35.2", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-arm64": "1.3.1" }, "os": "linux", "cpu": "arm64" }, "sha512-siWbOW1u6HFnFLrp0waKyW7VEf7jYvcDWdrXEFa8AkdAQgEvuu5Fz8/Y70w9EeqAdwDtfU012BhEHHaDqvQNzg=="],
-
-    "@img/sharp-linuxmusl-x64": ["@img/sharp-linuxmusl-x64@0.35.2", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-x64": "1.3.1" }, "os": "linux", "cpu": "x64" }, "sha512-YBqMMcjDi4QGYiSn4vNOYBhmlC4z5AXqkOUUqI2e0AFA4urNv4ESgOgwNl3K+4etQhha0twXlzeF20bbULm9Yg=="],
-
-    "@img/sharp-wasm32": ["@img/sharp-wasm32@0.35.2", "", { "dependencies": { "@emnapi/runtime": "^1.11.1" } }, "sha512-Mrv4JQNYVQ94xH+jzZ9r+gowleN8mv2FTgKT+PI6bx5C0G8TdNYndu161pg2i7uoBwxy2ImPMHrJOM2LZef7Bw=="],
-
-    "@img/sharp-webcontainers-wasm32": ["@img/sharp-webcontainers-wasm32@0.35.2", "", { "dependencies": { "@img/sharp-wasm32": "0.35.2" }, "cpu": "none" }, "sha512-QNV27pxs9wpApEiCfvHM1RDoP1w1+2KrUWWDPEhEwg+latvOrfuhWrHWZKwdSFwU6jh3myjw/yOCRsUIuOft3g=="],
-
-    "@img/sharp-win32-arm64": ["@img/sharp-win32-arm64@0.35.2", "", { "os": "win32", "cpu": "arm64" }, "sha512-BiVRYc/t6/Vl3e1hBx0hugG4oN9Pydf4fgMSpxTQJmwGUg/YoXTWHiFeRymHfCZzifxu4F4rpk/I67D0LQ20wQ=="],
-
-    "@img/sharp-win32-ia32": ["@img/sharp-win32-ia32@0.35.2", "", { "os": "win32", "cpu": "ia32" }, "sha512-YYEhx9PImCC7T0tI8JDMi4DB9LwLCXCU5OWNYEXAxh5Q1ShKkyC6byxzoBJ3gEFDnH2lQckWuDe70G7mB2XJog=="],
-
-    "@img/sharp-win32-x64": ["@img/sharp-win32-x64@0.35.2", "", { "os": "win32", "cpu": "x64" }, "sha512-imoOyBcoM/iiUr4J6VPpCNjPnjvP/Gks95898yB8YqoGGYmHYbOyCuNv9FMhFgtaiHFGbHW8bxKqRV6VjtXThQ=="],
-
-    "@jridgewell/resolve-uri": ["@jridgewell/resolve-uri@3.1.2", "", {}, "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw=="],
-
-    "@jridgewell/sourcemap-codec": ["@jridgewell/sourcemap-codec@1.5.5", "", {}, "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og=="],
-
-    "@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.9", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.0.3", "@jridgewell/sourcemap-codec": "^1.4.10" } }, "sha512-3Belt6tdc8bPgAtbcmdtNJlirVoTmEb5e2gC94PnkwEW9jI6CAHUeoG85tjWP5WquqfavoMtMwiG4P926ZKKuQ=="],
-
     "@oxc-project/types": ["@oxc-project/types@0.147.0", "", {}, "sha512-IJ3s6ltHLp45S0bh7phkX+gJO7A1Wuz2EaqpAhb8WjqDwbzMiWKHhyyT42tskaWjEYXtHtVCPpnBJVT9+dcRLg=="],
 
-    "@poppinss/colors": ["@poppinss/colors@4.1.6", "", { "dependencies": { "kleur": "^4.1.5" } }, "sha512-H9xkIdFswbS8n1d6vmRd8+c10t2Qe+rZITbbDHHkQixH5+2x1FDGmi/0K+WgWiqQFKPSlIYB7jlH6Kpfn6Fleg=="],
-
-    "@poppinss/dumper": ["@poppinss/dumper@0.6.5", "", { "dependencies": { "@poppinss/colors": "^4.1.5", "@sindresorhus/is": "^7.0.2", "supports-color": "^10.0.0" } }, "sha512-NBdYIb90J7LfOI32dOewKI1r7wnkiH6m920puQ3qHUeZkxNkQiFnXVWoE6YtFSv6QOiPPf7ys6i+HWWecDz7sw=="],
-
-    "@poppinss/exception": ["@poppinss/exception@1.2.3", "", {}, "sha512-dCED+QRChTVatE9ibtoaxc+WkdzOSjYTKi/+uacHWIsfodVfpsueo3+DKpgU5Px8qXjgmXkSvhXvSCz3fnP9lw=="],
-
     "@reduxjs/toolkit": ["@reduxjs/toolkit@2.12.0", "", { "dependencies": { "@standard-schema/spec": "^1.0.0", "@standard-schema/utils": "^0.3.0", "immer": "^11.0.0", "redux": "^5.0.1", "redux-thunk": "^3.1.0", "reselect": "^5.1.0" }, "peerDependencies": { "react": "^16.9.0 || ^17.0.0 || ^18 || ^19", "react-redux": "^7.2.1 || ^8.1.3 || ^9.0.0" }, "optionalPeers": ["react", "react-redux"] }, "sha512-KiT+RzZbp6mQET+Mg+h2c97+9j1sNflUxQkIHI7Yuzf6Peu+OYpmkn6nbHWmLLWj+1ZODUJFwGZ7gx3L9R9EOw=="],
 
     "@rolldown/binding-android-arm-eabi": ["@rolldown/binding-android-arm-eabi@1.2.6", "", { "os": "android", "cpu": "arm" }, "sha512-b+jTcARdTiFLI6jB4a5XjTm0RWd6KcRfQj/I2356fxUZemiho9zQLxo0RtCuMDAyKcLo6cEltkgbQp6d1+sjjQ=="],
@@ -204,10 +67,6 @@
 
     "@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.1", "", {}, "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw=="],
 
-    "@sindresorhus/is": ["@sindresorhus/is@7.2.0", "", {}, "sha512-P1Cz1dWaFfR4IR+U13mqqiGsLFf1KbayybWwdd2vfctdV6hDpUkgCY0nKOLLTMSoRd/jJNjtbqzf13K8DCCXQw=="],
-
-    "@speed-highlight/core": ["@speed-highlight/core@1.2.23", "", {}, "sha512-iRoq6i6JDJP6Mt2A5JaPvzw0pgYHH6k92ij+yXiTrB7T2y9N789aWE3EHWj/5ztlJBokcCBja3iYLVdu5wgnkg=="],
-
     "@standard-schema/spec": ["@standard-schema/spec@1.1.0", "", {}, "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w=="],
 
     "@standard-schema/utils": ["@standard-schema/utils@0.3.0", "", {}, "sha512-e7Mew686owMaPJVNNLs55PUvgz371nKgwsc4vxE49zsODpJEnxgxRo2y/OKrqueavXgZNMDVj3DdHFlaSAeU8g=="],
@@ -282,14 +141,10 @@
 
     "@vitejs/plugin-react": ["@vitejs/plugin-react@6.1.0", "", { "dependencies": { "@rolldown/pluginutils": "^1.0.1" }, "peerDependencies": { "@rolldown/plugin-babel": "^0.1.7 || ^0.2.0", "babel-plugin-react-compiler": "^1.0.0", "oxc-transform-react": "^0.145.0", "vite": "^8.0.0" }, "optionalPeers": ["@rolldown/plugin-babel", "babel-plugin-react-compiler", "oxc-transform-react"] }, "sha512-qd2BzUBehkov86WFhg0JkEFEYyCLG9uPCe6qWTY/kRlss9OvJrOF2UbIWT7p+8IzZHkEu0DNGHc4HSv+JdDLsw=="],
 
-    "blake3-wasm": ["blake3-wasm@2.1.5", "", {}, "sha512-F1+K8EbfOZE49dtoPtmxUQrpXaBIl3ICvasLh+nJta0xkz+9kF/7uet9fLnwKqhDrmj6g+6K3Tw9yQPUg2ka5g=="],
-
     "bun-types": ["bun-types@1.4.0", "", { "dependencies": { "@types/node": "*" } }, "sha512-iIKw23BspnQQYd3prITOBxeUsxBHnwzX6YJfGMuNOZzeNcMmVqzIIVGRm1l69ogaPQmb4wB6BN8mA5bE9YuC5Q=="],
 
     "clsx": ["clsx@2.1.1", "", {}, "sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA=="],
 
-    "cookie": ["cookie@1.1.1", "", {}, "sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ=="],
-
     "csstype": ["csstype@3.2.3", "", {}, "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ=="],
 
     "d3-array": ["d3-array@3.2.4", "", { "dependencies": { "internmap": "1 - 2" } }, "sha512-tdQAmyA18i4J7wprpYq8ClcxZy3SC31QMeByyCFyRt7BVHdREQZ5lpzoe5mFEYZUWe+oq8HBvk9JjpibyEV4Jg=="],
@@ -318,12 +173,8 @@
 
     "detect-libc": ["detect-libc@2.1.2", "", {}, "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ=="],
 
-    "error-stack-parser-es": ["error-stack-parser-es@1.0.5", "", {}, "sha512-5qucVt2XcuGMcEGgWI7i+yZpmpByQ8J1lHhcL7PwqCwu9FPP3VUXzT4ltHe5i2z9dePwEHcDVOAfSnHsOlCXRA=="],
-
     "es-toolkit": ["es-toolkit@1.50.0", "", {}, "sha512-OyZKhUVvEep9ITEiwHn8GKnMRQIVqoSIX7WnRbkWgJkllCujilqP2rD0u979tkl8wqyc8ICwlc1UBVv/Sl1G6w=="],
 
-    "esbuild": ["esbuild@0.28.1", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.28.1", "@esbuild/android-arm": "0.28.1", "@esbuild/android-arm64": "0.28.1", "@esbuild/android-x64": "0.28.1", "@esbuild/darwin-arm64": "0.28.1", "@esbuild/darwin-x64": "0.28.1", "@esbuild/freebsd-arm64": "0.28.1", "@esbuild/freebsd-x64": "0.28.1", "@esbuild/linux-arm": "0.28.1", "@esbuild/linux-arm64": "0.28.1", "@esbuild/linux-ia32": "0.28.1", "@esbuild/linux-loong64": "0.28.1", "@esbuild/linux-mips64el": "0.28.1", "@esbuild/linux-ppc64": "0.28.1", "@esbuild/linux-riscv64": "0.28.1", "@esbuild/linux-s390x": "0.28.1", "@esbuild/linux-x64": "0.28.1", "@esbuild/netbsd-arm64": "0.28.1", "@esbuild/netbsd-x64": "0.28.1", "@esbuild/openbsd-arm64": "0.28.1", "@esbuild/openbsd-x64": "0.28.1", "@esbuild/openharmony-arm64": "0.28.1", "@esbuild/sunos-x64": "0.28.1", "@esbuild/win32-arm64": "0.28.1", "@esbuild/win32-ia32": "0.28.1", "@esbuild/win32-x64": "0.28.1" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw=="],
-
     "eventemitter3": ["eventemitter3@5.0.4", "", {}, "sha512-mlsTRyGaPBjPedk6Bvw+aqbsXDtoAyAzm5MO7JgU+yVRyMQ5O8bD4Kcci7BS85f93veegeCPkL8R4GLClnjLFw=="],
 
     "fdir": ["fdir@6.5.0", "", { "peerDependencies": { "picomatch": "^3 || ^4" }, "optionalPeers": ["picomatch"] }, "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg=="],
@@ -334,8 +185,6 @@
 
     "internmap": ["internmap@2.0.3", "", {}, "sha512-5Hh7Y1wQbvY5ooGgPbDaL5iYLAPzMTUrjMulskHLH6wnv/A+1q5rgEaiuqEjB+oxGXIVZs1FF+R/KPN3ZSQYYg=="],
 
-    "kleur": ["kleur@4.1.5", "", {}, "sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ=="],
-
     "lightningcss": ["lightningcss@1.33.0", "", { "dependencies": { "detect-libc": "^2.0.3" }, "optionalDependencies": { "lightningcss-android-arm64": "1.33.0", "lightningcss-darwin-arm64": "1.33.0", "lightningcss-darwin-x64": "1.33.0", "lightningcss-freebsd-x64": "1.33.0", "lightningcss-linux-arm-gnueabihf": "1.33.0", "lightningcss-linux-arm64-gnu": "1.33.0", "lightningcss-linux-arm64-musl": "1.33.0", "lightningcss-linux-x64-gnu": "1.33.0", "lightningcss-linux-x64-musl": "1.33.0", "lightningcss-win32-arm64-msvc": "1.33.0", "lightningcss-win32-x64-msvc": "1.33.0" } }, "sha512-WkUDrojuJs0xkgGf2udWxa3yGBRxPtxUkB79i6aCZLRgc7PM8fZe9TosfPDcvEpQZbuFASnHYmRLBLUbmLOIIA=="],
 
     "lightningcss-android-arm64": ["lightningcss-android-arm64@1.33.0", "", { "os": "android", "cpu": "arm64" }, "sha512-gEpRTalKdosp4Bb8qWtc2iOgE5SeIHlpS1up9bFq2wAyYhl1UdTObYiHe98zEM9SQvSoqQZ1IQD0JNpg3Ml5pg=="],
@@ -362,16 +211,10 @@
 
     "lucide-react": ["lucide-react@1.34.0", "", { "peerDependencies": { "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-vnjGJNI7Htk5+oWW8gXGuaLgwgAb0T6/iZbBrp9JCfRFwdNWZ0YTm3eyxjOLgwN6r8iyAf3UA70zNmBRBNv7yg=="],
 
-    "miniflare": ["miniflare@5.20260826.0-alpha", "", { "dependencies": { "@cspotcode/source-map-support": "0.8.1", "sharp": "0.35.2", "undici": "7.29.0", "workerd": "1.20260826.1", "ws": "8.21.0", "youch": "4.1.0-beta.10" } }, "sha512-ZXR3Bieg+B5MK0T/zYIWaZiCGCb9Z3en4+/TleYKhIGPLx/e0cRcG/ZvvTviUapVBBK2zODB+aiypdIojU3x6Q=="],
-
     "nanoid": ["nanoid@3.3.18", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w=="],
 
     "nodeflare-ui": ["nodeflare-ui@workspace:frontend"],
 
-    "path-to-regexp": ["path-to-regexp@6.3.0", "", {}, "sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ=="],
-
-    "pathe": ["pathe@2.0.3", "", {}, "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w=="],
-
     "picocolors": ["picocolors@1.1.1", "", {}, "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA=="],
 
     "picomatch": ["picomatch@4.0.5", "", {}, "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A=="],
@@ -398,44 +241,22 @@
 
     "scheduler": ["scheduler@0.27.0", "", {}, "sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q=="],
 
-    "semver": ["semver@7.8.5", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA=="],
-
-    "sharp": ["sharp@0.35.2", "", { "dependencies": { "@img/colour": "^1.1.0", "detect-libc": "^2.1.2", "semver": "^7.8.4" }, "optionalDependencies": { "@img/sharp-darwin-arm64": "0.35.2", "@img/sharp-darwin-x64": "0.35.2", "@img/sharp-freebsd-wasm32": "0.35.2", "@img/sharp-libvips-darwin-arm64": "1.3.1", "@img/sharp-libvips-darwin-x64": "1.3.1", "@img/sharp-libvips-linux-arm": "1.3.1", "@img/sharp-libvips-linux-arm64": "1.3.1", "@img/sharp-libvips-linux-ppc64": "1.3.1", "@img/sharp-libvips-linux-riscv64": "1.3.1", "@img/sharp-libvips-linux-s390x": "1.3.1", "@img/sharp-libvips-linux-x64": "1.3.1", "@img/sharp-libvips-linuxmusl-arm64": "1.3.1", "@img/sharp-libvips-linuxmusl-x64": "1.3.1", "@img/sharp-linux-arm": "0.35.2", "@img/sharp-linux-arm64": "0.35.2", "@img/sharp-linux-ppc64": "0.35.2", "@img/sharp-linux-riscv64": "0.35.2", "@img/sharp-linux-s390x": "0.35.2", "@img/sharp-linux-x64": "0.35.2", "@img/sharp-linuxmusl-arm64": "0.35.2", "@img/sharp-linuxmusl-x64": "0.35.2", "@img/sharp-webcontainers-wasm32": "0.35.2", "@img/sharp-win32-arm64": "0.35.2", "@img/sharp-win32-ia32": "0.35.2", "@img/sharp-win32-x64": "0.35.2" } }, "sha512-FVtFjtBCMiJS6yb5CX7Sop45WFMpeGw6oRKuJnXYgf/f1ms/D7LE/ZUSNxnW7rZ/dbslQWYkoqFHGPaDBtaK4w=="],
-
     "source-map-js": ["source-map-js@1.2.1", "", {}, "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA=="],
 
-    "supports-color": ["supports-color@10.2.2", "", {}, "sha512-SS+jx45GF1QjgEXQx4NJZV9ImqmO2NPz5FNsIHrsDjh2YsHnawpan7SNQ1o8NuhrbHZy9AZhIoCUiCeaW/C80g=="],
-
     "tiny-invariant": ["tiny-invariant@1.3.3", "", {}, "sha512-+FbBPE1o9QAYvviau/qC5SE3caw21q3xkvWKBtja5vgqOWIHHJ3ioaq1VPfn/Szqctz2bU/oYeKd9/z5BL+PVg=="],
 
     "tinyglobby": ["tinyglobby@0.2.17", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.4" } }, "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g=="],
 
-    "tslib": ["tslib@2.8.1", "", {}, "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="],
-
     "typescript": ["typescript@7.0.2", "", { "optionalDependencies": { "@typescript/typescript-aix-ppc64": "7.0.2", "@typescript/typescript-darwin-arm64": "7.0.2", "@typescript/typescript-darwin-x64": "7.0.2", "@typescript/typescript-freebsd-arm64": "7.0.2", "@typescript/typescript-freebsd-x64": "7.0.2", "@typescript/typescript-linux-arm": "7.0.2", "@typescript/typescript-linux-arm64": "7.0.2", "@typescript/typescript-linux-loong64": "7.0.2", "@typescript/typescript-linux-mips64el": "7.0.2", "@typescript/typescript-linux-ppc64": "7.0.2", "@typescript/typescript-linux-riscv64": "7.0.2", "@typescript/typescript-linux-s390x": "7.0.2", "@typescript/typescript-linux-x64": "7.0.2", "@typescript/typescript-netbsd-arm64": "7.0.2", "@typescript/typescript-netbsd-x64": "7.0.2", "@typescript/typescript-openbsd-arm64": "7.0.2", "@typescript/typescript-openbsd-x64": "7.0.2", "@typescript/typescript-sunos-x64": "7.0.2", "@typescript/typescript-win32-arm64": "7.0.2", "@typescript/typescript-win32-x64": "7.0.2" }, "bin": { "tsc": "bin/tsc" } }, "sha512-8FYau96o3NKOhbjKi/qNvG/W5jhzxkbdm5sj9AbZ/5T5sWqn3hJgLfGx27sRKZWTvyzCP8dLRBTf5tBTSRVUNA=="],
 
-    "undici": ["undici@7.29.0", "", {}, "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw=="],
-
     "undici-types": ["undici-types@8.3.0", "", {}, "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ=="],
 
-    "unenv": ["unenv@2.0.0-rc.24", "", { "dependencies": { "pathe": "^2.0.3" } }, "sha512-i7qRCmY42zmCwnYlh9H2SvLEypEFGye5iRmEMKjcGi7zk9UquigRjFtTLz0TYqr0ZGLZhaMHl/foy1bZR+Cwlw=="],
-
     "use-sync-external-store": ["use-sync-external-store@1.6.0", "", { "peerDependencies": { "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-Pp6GSwGP/NrPIrxVFAIkOQeyw8lFenOHijQWkUTrDvrF4ALqylP2C/KCkeS9dpUM3KvYRQhna5vt7IL95+ZQ9w=="],
 
     "victory-vendor": ["victory-vendor@37.3.6", "", { "dependencies": { "@types/d3-array": "^3.0.3", "@types/d3-ease": "^3.0.0", "@types/d3-interpolate": "^3.0.1", "@types/d3-scale": "^4.0.2", "@types/d3-shape": "^3.1.0", "@types/d3-time": "^3.0.0", "@types/d3-timer": "^3.0.0", "d3-array": "^3.1.6", "d3-ease": "^3.0.1", "d3-interpolate": "^3.0.1", "d3-scale": "^4.0.2", "d3-shape": "^3.1.0", "d3-time": "^3.0.0", "d3-timer": "^3.0.1" } }, "sha512-SbPDPdDBYp+5MJHhBCAyI7wKM3d5ivekigc2Dk2s7pgbZ9wIgIBYGVw4zGHBml/qTFbexrofXW6Gu4noGxrOwQ=="],
 
     "vite": ["vite@8.2.2", "", { "dependencies": { "lightningcss": "^1.33.0", "picomatch": "^4.0.5", "postcss": "^8.5.26", "rolldown": "~1.2.4", "tinyglobby": "^0.2.17" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", "@vitejs/devtools": "^0.4.0 || ^0.5.0", "esbuild": "^0.27.0 || ^0.28.0", "jiti": ">=1.21.0", "less": "^4.0.0", "sass": "^1.70.0", "sass-embedded": "^1.70.0", "stylus": ">=0.54.8", "sugarss": "^5.0.0", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "@vitejs/devtools", "esbuild", "jiti", "less", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-cFKLV/PRgAUlIRm5WjMjJ86jrftzpqcgH+Us+DS8mI3CDNiH30Whrz8uHL3+MOLPAgqbMBAqWdAHAphOAM+z/Q=="],
 
-    "workerd": ["workerd@1.20260826.1", "", { "optionalDependencies": { "@cloudflare/workerd-darwin-64": "1.20260826.1", "@cloudflare/workerd-darwin-arm64": "1.20260826.1", "@cloudflare/workerd-linux-64": "1.20260826.1", "@cloudflare/workerd-linux-arm64": "1.20260826.1", "@cloudflare/workerd-windows-64": "1.20260826.1" }, "bin": { "workerd": "bin/workerd" } }, "sha512-oTG9ot5zxO9OjjKCskt86+nVrBL0kiUqExHnYaTg4OCkHf/K4zr+9hYvgwmG8DdCWG0TQGErHzD+1h50TM5b+w=="],
-
-    "wrangler": ["wrangler@4.127.0", "", { "dependencies": { "@cloudflare/kv-asset-handler": "0.5.0", "@cloudflare/unenv-preset": "2.16.1", "blake3-wasm": "2.1.5", "esbuild": "0.28.1", "miniflare": "5.20260826.0-alpha", "path-to-regexp": "6.3.0", "unenv": "2.0.0-rc.24", "workerd": "1.20260826.1" }, "optionalDependencies": { "fsevents": "2.3.3" }, "peerDependencies": { "@cloudflare/workers-types": "^5.20260826.1" }, "optionalPeers": ["@cloudflare/workers-types"], "bin": { "wrangler": "bin/wrangler.js", "wrangler2": "bin/wrangler.js", "cf-wrangler": "bin/cf-wrangler.js" } }, "sha512-4dPqcBEMJfGeZeNnjHT7ThNJs+EiNYxUTg4ywqIdQubcXHBhFeVMQyHV4A9AOhZRFr83cckqdds034KGcr/dtw=="],
-
     "ws": ["ws@8.21.3", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw=="],
-
-    "youch": ["youch@4.1.0-beta.10", "", { "dependencies": { "@poppinss/colors": "^4.1.5", "@poppinss/dumper": "^0.6.4", "@speed-highlight/core": "^1.2.7", "cookie": "^1.0.2", "youch-core": "^0.3.3" } }, "sha512-rLfVLB4FgQneDr0dv1oddCVZmKjcJ6yX6mS4pU82Mq/Dt9a3cLZQ62pDBL4AUO+uVrCvtWz3ZFUL2HFAFJ/BXQ=="],
-
-    "youch-core": ["youch-core@0.3.3", "", { "dependencies": { "@poppinss/exception": "^1.2.2", "error-stack-parser-es": "^1.0.5" } }, "sha512-ho7XuGjLaJ2hWHoK8yFnsUGy2Y5uDpqSTq1FkHLK4/oqKtyUU1AFbOOxY4IpC9f0fTLjwYbslUz0Po5BpD1wrA=="],
-
-    "miniflare/ws": ["ws@8.21.0", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g=="],
   }
 }
diff --git a/dev.sh b/dev.sh
new file mode 100755
index 0000000..36b9463
--- /dev/null
+++ b/dev.sh
@@ -0,0 +1,18 @@
+#!/bin/sh
+set -eu
+
+root_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+cd "$root_dir"
+
+if [ ! -f backend/config.toml ]; then
+  echo "配置文件不存在，从示例复制..."
+  cp backend/config.example.toml backend/config.toml
+  echo "请编辑 backend/config.toml（尤其是 admin_password）后重新运行"
+  exit 1
+fi
+
+echo "构建前端..."
+sh scripts/build-frontend.sh
+
+echo "启动后端（开发模式）..."
+exec cargo run --locked --manifest-path backend/Cargo.toml -- --config backend/config.toml
diff --git a/frontend/public/_headers b/frontend/public/_headers
deleted file mode 100644
index b367a23..0000000
--- a/frontend/public/_headers
+++ /dev/null
@@ -1,6 +0,0 @@
-/*
-  X-Content-Type-Options: nosniff
-  X-Frame-Options: DENY
-  Referrer-Policy: strict-origin-when-cross-origin
-  Permissions-Policy: camera=(), microphone=(), geolocation=()
-  Content-Security-Policy: default-src 'self'; script-src 'self' https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' ws: wss:; frame-src https://challenges.cloudflare.com; font-src 'self' data:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
diff --git a/frontend/src/App.tsx b/frontend/src/App.tsx
index 0ba82da..f1d6b53 100644
--- a/frontend/src/App.tsx
+++ b/frontend/src/App.tsx
@@ -5,6 +5,7 @@ import { NodeCard } from "./components/NodeCard";
 import { SiteLogo } from "./components/SiteLogo";
 import { StatsBar } from "./components/StatsBar";
 import { TurnstileWidget } from "./components/TurnstileWidget";
+import { ApiError } from "./api";
 import { ui } from "./locale";
 
 const NodeDetails = lazy(() => import("./components/NodeDetails").then((module) => ({ default: module.NodeDetails })));
@@ -15,6 +16,8 @@ function LoginGate() {
   const [password, setPassword] = useState("");
   const [turnstileToken, setTurnstileToken] = useState("");
   const [turnstileReset, setTurnstileReset] = useState(0);
+  const [totpCode, setTotpCode] = useState("");
+  const [totpRequired, setTotpRequired] = useState(false);
   const [busy, setBusy] = useState(false);
   const locale = config.locale;
 
@@ -24,10 +27,13 @@ function LoginGate() {
     setBusy(true);
     setError("");
     try {
-      await login(username, password, turnstileToken);
+      await login(username, password, turnstileToken, totpCode);
       setPassword("");
       setTurnstileToken("");
+      setTotpCode("");
+      setTotpRequired(false);
     } catch (reason) {
+      if (reason instanceof ApiError && reason.status === 428) setTotpRequired(true);
       setError(reason instanceof Error ? reason.message : ui(locale, "登录失败", "Unable to sign in"));
       setTurnstileToken("");
       setTurnstileReset((value) => value + 1);
@@ -46,6 +52,7 @@ function LoginGate() {
       <form className="dashboard-login-form" onSubmit={(event) => void submit(event)}>
         <label><span>{ui(locale, "用户名", "Username")}</span><input autoFocus autoComplete="username" value={username} onChange={(event) => setUsername(event.target.value)} required /></label>
         <label><span>{ui(locale, "密码", "Password")}</span><input type="password" autoComplete="current-password" value={password} onChange={(event) => setPassword(event.target.value)} required /></label>
+        {totpRequired ? <label><span>{ui(locale, "两步验证码", "Two-factor code")}</span><input autoFocus inputMode="numeric" autoComplete="one-time-code" pattern="[0-9]{6}" maxLength={6} value={totpCode} onChange={(event) => setTotpCode(event.target.value.replace(/\D/g, "").slice(0, 6))} required /></label> : null}
         {config.turnstile_login_enabled ? <div className="dashboard-login-turnstile"><TurnstileWidget siteKey={config.turnstile_site_key} action="admin-login" theme={dark ? "dark" : "light"} resetKey={turnstileReset} onVerify={setTurnstileToken} onError={setError} /></div> : null}
         {error ? <p className="form-error">{error}</p> : null}
         <button className="primary-btn dashboard-login-submit" disabled={busy || (config.turnstile_login_enabled && !turnstileToken)} type="submit"><KeyRound size={16} />{busy ? ui(locale, "登录中", "Signing in") : ui(locale, "登录", "Sign in")}</button>
diff --git a/frontend/src/AppProvider.tsx b/frontend/src/AppProvider.tsx
index c614f65..759c979 100644
--- a/frontend/src/AppProvider.tsx
+++ b/frontend/src/AppProvider.tsx
@@ -50,7 +50,7 @@ export interface AppState {
   openServer: (server: Server) => void;
   goHome: () => void;
   reload: () => Promise<void>;
-  login: (username: string, password: string, turnstileToken: string) => Promise<void>;
+  login: (username: string, password: string, turnstileToken: string, totpCode: string) => Promise<void>;
   verify: (token: string) => Promise<void>;
 }
 
@@ -87,6 +87,7 @@ export function AppProvider({ children }: { children: ReactNode }) {
   const liveConnectedRef = useRef(false);
   const playbackRef = useRef<PlaybackBuffer>(new Map());
   const serversRef = useRef<Server[]>([]);
+  const themeSwitchFrame = useRef<number | null>(null);
 
   const dark = appearance ? appearance === "dark" : config.default_theme === "system" ? systemDark : config.default_theme === "dark";
   const background = resolveBackground(config.background_url, dark);
@@ -132,9 +133,9 @@ export function AppProvider({ children }: { children: ReactNode }) {
     }
   }, []);
 
-  const login = useCallback(async (username: string, password: string, turnstileToken: string) => {
+  const login = useCallback(async (username: string, password: string, turnstileToken: string, totpCode: string) => {
     const derived = await derivePassword(password, config.password_client_salt);
-    const result = await api.login(username.trim(), password, derived, turnstileToken);
+    const result = await api.login(username.trim(), password, derived, turnstileToken, totpCode);
     setToken(result.token);
     setAccess("ok");
     await reload();
@@ -259,6 +260,24 @@ export function AppProvider({ children }: { children: ReactNode }) {
     setAppearance((current) => {
       const resolved = current ?? (dark ? "dark" : "light");
       const next = resolved === "dark" ? "light" : "dark";
+
+      // Komari 优化：标记主题切换中，避免过渡动画闪烁
+      const root = document.documentElement;
+      root.dataset.themeSwitching = "true";
+      root.classList.toggle("dark", next === "dark");
+      root.style.colorScheme = next;
+
+      // 双帧延迟后移除标记
+      if (themeSwitchFrame.current !== null) {
+        cancelAnimationFrame(themeSwitchFrame.current);
+      }
+      themeSwitchFrame.current = requestAnimationFrame(() => {
+        themeSwitchFrame.current = requestAnimationFrame(() => {
+          delete root.dataset.themeSwitching;
+          themeSwitchFrame.current = null;
+        });
+      });
+
       localStorage.setItem("nodeflare-theme", next);
       return next;
     });
@@ -287,5 +306,14 @@ export function AppProvider({ children }: { children: ReactNode }) {
     verify,
   }), [access, background, blur, carrierLatency, config, configReady, dark, error, exchangeRates, goHome, liveMetrics, liveServers, loading, login, openServer, reload, selectedId, toggleTheme, verify]);
 
+  // 组件卸载时清理动画帧
+  useEffect(() => {
+    return () => {
+      if (themeSwitchFrame.current !== null) {
+        cancelAnimationFrame(themeSwitchFrame.current);
+      }
+    };
+  }, []);
+
   return <AppContext.Provider value={value}>{children}</AppContext.Provider>;
 }
diff --git a/frontend/src/api.ts b/frontend/src/api.ts
index 2e3e1ce..c1d8d56 100644
--- a/frontend/src/api.ts
+++ b/frontend/src/api.ts
@@ -1,4 +1,4 @@
-import type { AdminServer, AlertRule, AlertRuleInput, Bootstrap, CloudflareUsage, Config, DatabaseStats, ExchangeRates, HistoryPoint, LatencySample, LatencyTask, LatencyTaskInput, LatencyTestPoint, Server, ServerInput, Settings, TelegramSettings, TelegramSettingsInput, Theme, ThemeSettingsSchema } from "./types";
+import type { AdminServer, AlertRule, AlertRuleInput, Bootstrap, Config, DatabaseStats, ExchangeRates, HistoryPoint, LatencySample, LatencyTask, LatencyTaskInput, LatencyTestPoint, RemoteTask, RemoteTaskInput, Server, ServerInput, Settings, TelegramSettings, TelegramSettingsInput, Theme, ThemeSettingsSchema, TotpSetup, TotpStatus } from "./types";
 
 const TOKEN_KEY = "nodeflare-admin-token";
 export const ADMIN_UNAUTHORIZED_EVENT = "nodeflare:admin-unauthorized";
@@ -54,13 +54,23 @@ export const api = {
     request<{ tasks: LatencyTestPoint[]; points: LatencySample[] }>(`/api/latency/${encodeURIComponent(id)}?hours=${hours}`),
   verifyTurnstile: (token: string) =>
     request<void>("/api/turnstile/verify", { method: "POST", body: JSON.stringify({ token }) }),
-  login: (username: string, password: string, passwordDerived: string, turnstileToken: string) =>
+  login: (username: string, password: string, passwordDerived: string, turnstileToken: string, totpCode = "") =>
     request<{ token: string }>("/api/admin/login", {
       method: "POST",
-      body: JSON.stringify({ username, password, password_derived: passwordDerived, turnstile_token: turnstileToken }),
+      body: JSON.stringify({ username, password, password_derived: passwordDerived, turnstile_token: turnstileToken, totp_code: totpCode }),
     }),
   logout: () => request<void>("/api/admin/logout", { method: "POST" }),
   settings: () => request<Settings>("/api/admin/settings", {}, true),
+  twoFactorStatus: () => request<TotpStatus>("/api/admin/2fa/status", {}, true),
+  setupTwoFactor: () => request<TotpSetup>("/api/admin/2fa/setup", { method: "POST" }, true),
+  enableTwoFactor: (totpCode: string) => request<void>("/api/admin/2fa/enable", {
+    method: "POST",
+    body: JSON.stringify({ totp_code: totpCode }),
+  }, true),
+  disableTwoFactor: (totpCode: string) => request<void>("/api/admin/2fa/disable", {
+    method: "POST",
+    body: JSON.stringify({ totp_code: totpCode }),
+  }, true),
   latencyTasks: () => request<{ tasks: LatencyTask[] }>("/api/admin/latency-tasks", {}, true),
   createLatencyTask: (input: LatencyTaskInput) =>
     request<{ id: string }>("/api/admin/latency-tasks", { method: "POST", body: JSON.stringify(input) }, true),
@@ -123,6 +133,11 @@ export const api = {
       true,
     ),
   databaseStats: () => request<DatabaseStats>("/api/admin/database", {}, true),
-  cloudflareUsage: () => request<CloudflareUsage>("/api/admin/cloudflare-usage", {}, true),
   clearHistory: () => request<void>("/api/admin/history", { method: "DELETE" }, true),
+  createRemoteTask: (input: RemoteTaskInput) => request<{ task_id: string }>("/api/admin/remote/task", {
+    method: "POST",
+    body: JSON.stringify(input),
+  }, true),
+  remoteTask: (id: string) => request<RemoteTask>(`/api/admin/remote/task/${encodeURIComponent(id)}`, {}, true),
+  remoteTasks: (serverId: string) => request<RemoteTask[]>(`/api/admin/remote/tasks/${encodeURIComponent(serverId)}`, {}, true),
 };
diff --git a/frontend/src/components/AdminPanel.tsx b/frontend/src/components/AdminPanel.tsx
index 0436360..b9b6838 100644
--- a/frontend/src/components/AdminPanel.tsx
+++ b/frontend/src/components/AdminPanel.tsx
@@ -5,7 +5,6 @@ import {
   ChevronDown,
   ChevronUp,
   CircleAlert,
-  Cloud,
   CircleCheck,
   Coins,
   Copy,
@@ -26,6 +25,7 @@ import {
   ShieldCheck,
   SlidersHorizontal,
   Sun,
+  Terminal,
   Trash2,
   Check,
   ExternalLink,
@@ -34,7 +34,7 @@ import { ChangeEvent, DragEvent, FormEvent, useCallback, useEffect, useMemo, use
 import { ADMIN_UNAUTHORIZED_EVENT, api, ApiError, getToken, setToken } from "../api";
 import { formatByteSize, isOnline, parseByteSize } from "../format";
 import { derivePassword } from "../password";
-import { ASSET_CURRENCIES, type AdminServer, type CloudflareUsage, type Config, type DatabaseStats, type ExchangeRates, type ServerInput, type Settings, type Theme, type ThemeSettingField, type ThemeSettingsSchema, type ThemeSettingValue } from "../types";
+import { ASSET_CURRENCIES, type AdminServer, type Config, type DatabaseStats, type ExchangeRates, type RemoteTask, type ServerInput, type Settings, type Theme, type ThemeSettingField, type ThemeSettingsSchema, type ThemeSettingValue, type TotpSetup, type TotpStatus } from "../types";
 import { Checkbox } from "./Checkbox";
 import { TurnstileWidget } from "./TurnstileWidget";
 import { useDialog } from "./useDialog";
@@ -47,7 +47,7 @@ import pkg from "../../package.json";
 
 const VERSION = import.meta.env.VITE_NODEFLARE_VERSION || pkg.version;
 
-type AdminTab = "servers" | "latency" | "appearance" | "themes" | "themeSettings" | "alerts" | "security" | "data" | "about";
+type AdminTab = "servers" | "latency" | "appearance" | "themes" | "themeSettings" | "alerts" | "security" | "data" | "remote" | "about";
 type AgentPlatform = "linux" | "windows" | "macos" | "freebsd";
 
 interface AgentInstallInfo {
@@ -63,7 +63,8 @@ const adminPages: Record<AdminTab, { title: string; description: string }> = {
   themeSettings: { title: "主题设置", description: "调整当前前端主题提供的显示选项" },
   alerts: { title: "通知", description: "配置 Telegram 通知和资源告警阈值" },
   security: { title: "登录与安全", description: "管理管理员账号和 Cloudflare Turnstile 防护" },
-  data: { title: "监控数据库", description: "查看 D1 用量、汇率状态并维护历史数据" },
+  data: { title: "监控数据库", description: "查看数据库统计、汇率状态并维护历史数据" },
+  remote: { title: "远程执行", description: "向在线节点发送命令或脚本并查看执行结果" },
   about: { title: "关于", description: "版本信息与项目地址" },
 };
 
@@ -180,6 +181,8 @@ export function AdminPanel({
   const [password, setPassword] = useState("");
   const [turnstileToken, setTurnstileToken] = useState("");
   const [turnstileReset, setTurnstileReset] = useState(0);
+  const [loginTotpCode, setLoginTotpCode] = useState("");
+  const [loginTotpRequired, setLoginTotpRequired] = useState(false);
   const [busy, setBusy] = useState(false);
   const [error, setError] = useState("");
   const [notice, setNotice] = useState("");
@@ -189,7 +192,6 @@ export function AdminPanel({
   const [draggingId, setDraggingId] = useState("");
   const [settings, setSettings] = useState<Settings | null>(null);
   const [database, setDatabase] = useState<DatabaseStats | null>(null);
-  const [cloudflareUsage, setCloudflareUsage] = useState<CloudflareUsage | null>(null);
   const [exchangeRates, setExchangeRates] = useState<ExchangeRates | null>(null);
   const [themes, setThemes] = useState<Theme[]>([]);
   const [themeName, setThemeName] = useState("");
@@ -208,16 +210,32 @@ export function AdminPanel({
   const [rxBaseBytes, setRxBaseBytes] = useState(0);
   const [txBaseBytes, setTxBaseBytes] = useState(0);
   const [installPlatform, setInstallPlatform] = useState<AgentPlatform>("linux");
+  const [selectedServerId, setSelectedServerId] = useState<string>("");
+  const [remoteCommand, setRemoteCommand] = useState("");
+  const [remoteScript, setRemoteScript] = useState("");
+  const [remoteMode, setRemoteMode] = useState<"command" | "script">("command");
+  const [remoteTasks, setRemoteTasks] = useState<RemoteTask[]>([]);
+  const [remoteTotpCode, setRemoteTotpCode] = useState("");
+  const [twoFactorStatus, setTwoFactorStatus] = useState<TotpStatus | null>(null);
+  const [twoFactorSetup, setTwoFactorSetup] = useState<TotpSetup | null>(null);
+  const [twoFactorCode, setTwoFactorCode] = useState("");
+
 
   const load = useCallback(async () => {
     if (!getToken()) return;
     setBusy(true);
     setError("");
     try {
-      const [serverResult, settingsResult, themesResult] = await Promise.all([api.adminServers(), api.settings(), api.themes()]);
+      const [serverResult, settingsResult, themesResult, twoFactorResult] = await Promise.all([
+        api.adminServers(),
+        api.settings(),
+        api.themes(),
+        api.twoFactorStatus(),
+      ]);
       setServers(serverResult.servers);
       setThemes(themesResult.themes);
       setSettings(settingsResult);
+      setTwoFactorStatus(twoFactorResult);
       setAuthenticated(true);
     } catch (reason) {
       if (reason instanceof ApiError && reason.status === 401) {
@@ -262,13 +280,16 @@ export function AdminPanel({
     setError("");
     try {
       const passwordDerived = await derivePassword(password, config.password_client_salt);
-      const result = await api.login(username.trim(), password, passwordDerived, turnstileToken);
+      const result = await api.login(username.trim(), password, passwordDerived, turnstileToken, loginTotpCode);
       setToken(result.token);
       setPassword("");
       setTurnstileToken("");
+      setLoginTotpCode("");
+      setLoginTotpRequired(false);
       setAuthenticated(true);
       await load();
     } catch (reason) {
+      if (reason instanceof ApiError && reason.status === 428) setLoginTotpRequired(true);
       setError(reason instanceof Error ? reason.message : "登录失败");
       setTurnstileToken("");
       setTurnstileReset((value) => value + 1);
@@ -465,13 +486,6 @@ export function AdminPanel({
     finally { setBusy(false); }
   }
 
-  async function loadCloudflareUsage() {
-    setBusy(true); setError("");
-    try { setCloudflareUsage(await api.cloudflareUsage()); }
-    catch (reason) { setError(reason instanceof Error ? reason.message : "读取 Cloudflare 用量失败"); }
-    finally { setBusy(false); }
-  }
-
   async function loadThemeSettings() {
     setBusy(true); setError("");
     try { setThemeSettingsSchema(await api.themeSettings()); }
@@ -544,6 +558,53 @@ export function AdminPanel({
     try { await api.logout(); }
     finally {
       setToken(""); setAuthenticated(false); setServers([]); setSettings(null); setSelectedIds([]);
+      setTwoFactorStatus(null); setTwoFactorSetup(null); setTwoFactorCode(""); setRemoteTotpCode("");
+    }
+  }
+
+  async function setupTwoFactor() {
+    setBusy(true); setError(""); setNotice("");
+    try {
+      const setup = await api.setupTwoFactor();
+      setTwoFactorSetup(setup);
+      setTwoFactorStatus({ enabled: false, has_secret: true });
+      setTwoFactorCode("");
+      setNotice("两步验证密钥已生成，请先加入验证器再启用");
+    } catch (reason) { setError(reason instanceof Error ? reason.message : "生成两步验证密钥失败"); }
+    finally { setBusy(false); }
+  }
+
+  async function enableTwoFactor() {
+    if (!/^\d{6}$/.test(twoFactorCode)) { setError("请输入 6 位两步验证码"); return; }
+    setBusy(true); setError(""); setNotice("");
+    try {
+      await api.enableTwoFactor(twoFactorCode);
+      setTwoFactorStatus({ enabled: true, has_secret: true });
+      setTwoFactorSetup(null);
+      setTwoFactorCode("");
+      setNotice("两步验证已启用");
+    } catch (reason) { setError(reason instanceof Error ? reason.message : "启用两步验证失败"); }
+    finally { setBusy(false); }
+  }
+
+  async function disableTwoFactor() {
+    if (!/^\d{6}$/.test(twoFactorCode)) { setError("请输入 6 位两步验证码"); return; }
+    setBusy(true); setError(""); setNotice("");
+    try {
+      await api.disableTwoFactor(twoFactorCode);
+      setTwoFactorStatus({ enabled: false, has_secret: true });
+      setTwoFactorCode("");
+      setNotice("两步验证已禁用");
+    } catch (reason) { setError(reason instanceof Error ? reason.message : "禁用两步验证失败"); }
+    finally { setBusy(false); }
+  }
+
+  async function copyTwoFactorValue(value: string) {
+    try {
+      await navigator.clipboard.writeText(value);
+      setNotice("已复制");
+    } catch {
+      setError("复制失败，请手动选择复制");
     }
   }
 
@@ -583,6 +644,55 @@ export function AdminPanel({
   };
   const siteLogoUrl = settings ? settings.logo_url : config.logo_url;
 
+  const createRemoteTask = async () => {
+    if (!selectedServerId) {
+      setError("请选择服务器");
+      return;
+    }
+    if (remoteMode === "command" && !remoteCommand.trim()) {
+      setError("请输入命令");
+      return;
+    }
+    if (remoteMode === "script" && !remoteScript.trim()) {
+      setError("请输入脚本");
+      return;
+    }
+    if (twoFactorStatus?.enabled && !/^\d{6}$/.test(remoteTotpCode)) {
+      setError("远程执行需要 6 位两步验证码");
+      return;
+    }
+
+    setBusy(true);
+    setError("");
+    try {
+      const data = await api.createRemoteTask({
+        server_id: selectedServerId,
+        command: remoteMode === "command" ? remoteCommand : "",
+        script: remoteMode === "script" ? remoteScript : "",
+        totp_code: remoteTotpCode,
+      });
+      setNotice(`任务已创建: ${data.task_id}`);
+      setRemoteCommand("");
+      setRemoteScript("");
+      setRemoteTotpCode("");
+      void loadRemoteTasks(selectedServerId);
+    } catch (err) {
+      setError(err instanceof Error ? err.message : "创建任务失败");
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  const loadRemoteTasks = async (serverId = selectedServerId) => {
+    if (!serverId) return;
+
+    try {
+      setRemoteTasks(await api.remoteTasks(serverId));
+    } catch (err) {
+      setError(err instanceof Error ? err.message : "加载任务列表失败");
+    }
+  };
+
   return (
     <div className={`admin-page ${dark ? "admin-dark" : ""}`}>
       {/* toast 的定位是按后台的顶栏算的；登录页没有顶栏，那里的错误走表单内提示 */}
@@ -595,9 +705,10 @@ export function AdminPanel({
           <div className="login-copy"><h1>管理员登录</h1><p>{config.site_name}</p></div>
           <label><span>用户名</span><input autoFocus type="text" autoComplete="username" value={username} onChange={(event) => setUsername(event.target.value)} required aria-invalid={error ? true : undefined} aria-describedby={error ? "login-error" : undefined} /></label>
           <label><span>密码</span><input type="password" autoComplete="current-password" value={password} onChange={(event) => setPassword(event.target.value)} required aria-invalid={error ? true : undefined} aria-describedby={error ? "login-error" : undefined} /></label>
-          {config.turnstile_login_enabled || config.turnstile_enabled ? <div className="login-turnstile"><TurnstileWidget siteKey={config.turnstile_site_key} action="admin-login" theme={dark ? "dark" : "light"} resetKey={turnstileReset} onVerify={setTurnstileToken} onError={setError} /></div> : null}
+          {loginTotpRequired ? <label><span>两步验证码</span><input autoFocus inputMode="numeric" autoComplete="one-time-code" pattern="[0-9]{6}" maxLength={6} value={loginTotpCode} onChange={(event) => setLoginTotpCode(event.target.value.replace(/\D/g, "").slice(0, 6))} required aria-invalid={error ? true : undefined} aria-describedby={error ? "login-error" : undefined} /></label> : null}
+          {config.turnstile_login_enabled ? <div className="login-turnstile"><TurnstileWidget siteKey={config.turnstile_site_key} action="admin-login" theme={dark ? "dark" : "light"} resetKey={turnstileReset} onVerify={setTurnstileToken} onError={setError} /></div> : null}
           {error ? <p className="login-error" id="login-error" role="alert"><CircleAlert size={15} aria-hidden="true" />{error}</p> : null}
-          <button className="primary-btn login-submit" disabled={busy || ((config.turnstile_login_enabled || config.turnstile_enabled) && !turnstileToken)} type="submit"><KeyRound size={15} />{busy ? "验证中" : "登录"}</button>
+          <button className="primary-btn login-submit" disabled={busy || (config.turnstile_login_enabled && !turnstileToken)} type="submit"><KeyRound size={15} />{busy ? "验证中" : "登录"}</button>
         </form>
       </div> : <section className="admin-shell" aria-label="管理面板">
         <header className="admin-topbar">
@@ -629,6 +740,7 @@ export function AdminPanel({
                 <button type="button" className={tab === "alerts" ? "active" : ""} aria-current={tab === "alerts" ? "page" : undefined} onClick={() => selectTab("alerts")}><AlertTriangle size={17} />通知</button>
                 <button type="button" className={tab === "security" ? "active" : ""} aria-current={tab === "security" ? "page" : undefined} onClick={() => selectTab("security")}><ShieldCheck size={17} />登录与安全</button>
                 <button type="button" className={tab === "data" ? "active" : ""} aria-current={tab === "data" ? "page" : undefined} onClick={() => { selectTab("data"); if (!database) void loadDatabase(); }}><Database size={17} />监控数据库</button>
+                <button type="button" className={tab === "remote" ? "active" : ""} aria-current={tab === "remote" ? "page" : undefined} onClick={() => selectTab("remote")}><Terminal size={17} />远程执行</button>
                 <button type="button" className={tab === "about" ? "active" : ""} aria-current={tab === "about" ? "page" : undefined} onClick={() => selectTab("about")}><Info size={17} />关于</button>
               </nav>
             </aside>
@@ -711,33 +823,112 @@ export function AdminPanel({
                   {tab === "security" ? <>
                     <div className="section-title"><ShieldCheck size={15} />账号与 Cloudflare 防护</div>
                     <div className="form-grid"><label><span>管理员用户名</span><input autoComplete="username" value={settings.admin_username} onChange={(event) => updateSettings("admin_username", event.target.value)} /></label><label><span>新密码（留空不修改）</span><input autoComplete="new-password" type="password" value={settings.new_password || ""} onChange={(event) => updateSettings("new_password", event.target.value)} placeholder="至少 8 个字符" /></label></div>
+                    <div className="two-factor-panel">
+                      <div className="two-factor-head"><div><div className="section-subtitle">TOTP 两步验证</div><p className="settings-hint">登录与远程执行可使用验证器生成的 6 位动态验证码保护。</p></div><span className={`two-factor-status ${twoFactorStatus?.enabled ? "enabled" : ""}`}>{twoFactorStatus?.enabled ? "已启用" : twoFactorStatus ? "未启用" : "读取中"}</span></div>
+                      {twoFactorSetup ? <div className="two-factor-setup">
+                        <label><span>验证器密钥</span><div className="copy-field"><input readOnly value={twoFactorSetup.secret} /><button type="button" className="secondary-btn compact" onClick={() => void copyTwoFactorValue(twoFactorSetup.secret)}><Copy size={14} />复制</button></div></label>
+                        <label><span>配置 URI</span><div className="copy-field"><input readOnly value={twoFactorSetup.uri} /><button type="button" className="secondary-btn compact" onClick={() => void copyTwoFactorValue(twoFactorSetup.uri)}><Copy size={14} />复制</button></div></label>
+                        <p className="settings-hint">将密钥或 URI 加入 Google Authenticator、Aegis、2FAS 等验证器，再输入当前验证码确认。</p>
+                      </div> : null}
+                      {twoFactorStatus?.enabled ? <div className="two-factor-actions"><label><span>当前验证码</span><input inputMode="numeric" autoComplete="one-time-code" pattern="[0-9]{6}" maxLength={6} value={twoFactorCode} onChange={(event) => setTwoFactorCode(event.target.value.replace(/\D/g, "").slice(0, 6))} placeholder="000000" /></label><button type="button" className="danger-btn" disabled={busy} onClick={() => void disableTwoFactor()}>禁用两步验证</button></div> : <div className="two-factor-actions">
+                        {twoFactorSetup ? <label><span>当前验证码</span><input inputMode="numeric" autoComplete="one-time-code" pattern="[0-9]{6}" maxLength={6} value={twoFactorCode} onChange={(event) => setTwoFactorCode(event.target.value.replace(/\D/g, "").slice(0, 6))} placeholder="000000" /></label> : <p className="settings-hint">{twoFactorStatus?.has_secret ? "已有未启用的密钥；重新生成后，旧密钥会失效。" : "尚未生成两步验证密钥。"}</p>}
+                        <button type="button" className="secondary-btn" disabled={busy} onClick={() => void setupTwoFactor()}>{twoFactorStatus?.has_secret ? "重新生成密钥" : "生成密钥"}</button>
+                        {twoFactorSetup ? <button type="button" className="primary-btn" disabled={busy} onClick={() => void enableTwoFactor()}>启用两步验证</button> : null}
+                      </div>}
+                    </div>
                     <div className="form-grid"><Toggle label="保护公开仪表盘" checked={settings.turnstile_enabled} onChange={(value) => updateSettings("turnstile_enabled", value)} /><Toggle label="保护管理员登录" checked={settings.turnstile_login_enabled} onChange={(value) => updateSettings("turnstile_login_enabled", value)} /></div>
                     <div className="form-grid"><label><span>Turnstile Site Key</span><input autoComplete="off" type="password" value={settings.turnstile_site_key} onChange={(event) => updateSettings("turnstile_site_key", event.target.value)} /></label><label><span>Turnstile Secret Key</span><input autoComplete="off" type="password" value={settings.turnstile_secret_key} onChange={(event) => updateSettings("turnstile_secret_key", event.target.value)} /></label></div>
-                    <p className="settings-hint">留空则读取后台配置。</p>
+                    <p className="settings-hint">已配置的密钥显示为 ********；两项同时清空可禁用 Turnstile。</p>
                   </> : null}
 
                   {tab === "data" ? <>
-                    <div className="section-title"><Database size={15} />D1 数据维护</div>
+                    <div className="section-title"><Database size={15} />数据库维护</div>
                     <div className="data-stat-grid">{database ? <><DataStat label="节点" value={database.server_count} /><DataStat label="在线" value={database.online_count} /><DataStat label="历史行数" value={database.history_rows.toLocaleString()} /></> : <p className="settings-hint">正在读取数据库统计...</p>}</div>
                     <div className="usage-section">
-                      <div className="usage-head"><div><div className="section-title"><Coins size={15} />每日汇率</div><p className="settings-hint">{exchangeRates ? `${exchangeRates.source} · ${exchangeRates.date || "等待首次更新"}${exchangeRates.stale ? " · 数据待更新" : ""}` : "正在读取 D1 汇率快照"}</p></div><button type="button" className="secondary-btn compact" disabled={busy} onClick={() => void refreshExchangeRates()}><RotateCw size={15} />立即更新</button></div>
+                      <div className="usage-head"><div><div className="section-title"><Coins size={15} />每日汇率</div><p className="settings-hint">{exchangeRates ? `${exchangeRates.source} · ${exchangeRates.date || "等待首次更新"}${exchangeRates.stale ? " · 数据待更新" : ""}` : "正在读取汇率快照"}</p></div><button type="button" className="secondary-btn compact" disabled={busy} onClick={() => void refreshExchangeRates()}><RotateCw size={15} />立即更新</button></div>
                       {exchangeRates ? <div className="usage-table-wrap"><table className="usage-table"><thead><tr><th>币种</th><th>1 CNY 可兑换</th></tr></thead><tbody>{ASSET_CURRENCIES.filter((currency) => currency !== "CNY").map((currency) => <tr key={currency}><th scope="row">{currency}</th><td>{exchangeRates.rates[currency]?.toLocaleString(undefined, { maximumFractionDigits: 6 }) ?? "--"}</td></tr>)}</tbody></table></div> : <div className="usage-empty">尚未读取</div>}
                     </div>
-                    <div className="usage-section">
-                      <div className="usage-head"><div><div className="section-title"><Cloud size={15} />Cloudflare 用量</div><p className="settings-hint">统计周期使用 UTC</p></div><button type="button" className="secondary-btn compact" disabled={busy} onClick={() => void loadCloudflareUsage()}><RotateCw size={15} />{cloudflareUsage ? "刷新用量" : "查询用量"}</button></div>
-                      <div className="form-grid"><label><span>Cloudflare Account ID</span><input autoComplete="off" type="password" maxLength={32} value={settings.cloudflare_account_id} onChange={(event) => updateSettings("cloudflare_account_id", event.target.value)} placeholder="32 位账户 ID" /></label><label><span>Cloudflare API Token</span><input autoComplete="off" type="password" value={settings.cloudflare_api_token} onChange={(event) => updateSettings("cloudflare_api_token", event.target.value)} placeholder="Account Analytics: Read" /></label></div>
-                      <div className="usage-config-actions"><p className="settings-hint">Token 需要账户级 Account Analytics: Read 权限，并授权对应账户；留空读取 Worker Secret。</p><button type="submit" className="primary-btn compact" disabled={busy}><Save size={15} />保存用量配置</button></div>
-                      {cloudflareUsage ? <><div className="usage-table-wrap"><table className="usage-table cloudflare-usage-table"><thead><tr><th>周期</th><th>D1 读取</th><th>D1 写入</th><th>Workers 请求</th><th>DO 请求（估算）</th><th>DO 时长 (GB-s)</th></tr></thead><tbody><UsageRow label="今日" usage={cloudflareUsage.today} /><UsageRow label="昨日" usage={cloudflareUsage.yesterday} /></tbody></table></div><div className="usage-do-breakdown"><UsageDoBreakdown label="今日" usage={cloudflareUsage.today} /><UsageDoBreakdown label="昨日" usage={cloudflareUsage.yesterday} /></div></> : <div className="usage-empty">尚未读取</div>}
-                    </div>
                     <div className="data-actions"><button type="button" className="secondary-btn" onClick={() => void loadDatabase()}>刷新统计</button><button type="button" className="danger-btn" onClick={() => void clearHistory()}><Trash2 size={15} />清空历史指标</button></div>
                     <p className="settings-hint">清空历史不会删除节点、密钥或最新状态。</p>
                   </> : null}
 
                   {tab !== "data" ? <div className="form-actions"><button className="primary-btn" disabled={busy}><Save size={15} />保存{tab === "security" ? "账号与安全设置" : "设置"}</button></div> : null}
                 </form>
+              ) : tab === "remote" ? (
+                <div className="admin-section">
+                  <div className="section-head"><h3>创建远程任务</h3>{selectedServerId ? <button type="button" className="secondary-btn compact" disabled={busy} onClick={() => void loadRemoteTasks(selectedServerId)}><RotateCw size={14} />刷新任务</button> : null}</div>
+                  <div className="form-grid">
+                    <label>
+                      <span>目标服务器</span>
+                      <select value={selectedServerId} onChange={(e) => { const serverId = e.target.value; setSelectedServerId(serverId); if (serverId) void loadRemoteTasks(serverId); else setRemoteTasks([]); }}>
+                        <option value="">请选择服务器</option>
+                        {servers.map((server) => (
+                          <option key={server.id} value={server.id}>{server.name}</option>
+                        ))}
+                      </select>
+                    </label>
+                  </div>
+                  <div className="segmented" role="group" aria-label="执行模式">
+                    <button type="button" className={remoteMode === "command" ? "active" : ""} aria-pressed={remoteMode === "command"} onClick={() => setRemoteMode("command")}>命令模式</button>
+                    <button type="button" className={remoteMode === "script" ? "active" : ""} aria-pressed={remoteMode === "script"} onClick={() => setRemoteMode("script")}>脚本模式</button>
+                  </div>
+                  {remoteMode === "command" ? (
+                    <label>
+                      <span>命令</span>
+                      <input
+                        value={remoteCommand}
+                        onChange={(e) => setRemoteCommand(e.target.value)}
+                        placeholder="例如: df -h"
+                      />
+                    </label>
+                  ) : (
+                    <label>
+                      <span>脚本内容</span>
+                      <textarea
+                        rows={8}
+                        value={remoteScript}
+                        onChange={(e) => setRemoteScript(e.target.value)}
+                        placeholder="输入 Bash 脚本..."
+                      />
+                    </label>
+                  )}
+                  {twoFactorStatus?.enabled ? <label><span>两步验证码</span><input inputMode="numeric" autoComplete="one-time-code" pattern="[0-9]{6}" maxLength={6} value={remoteTotpCode} onChange={(event) => setRemoteTotpCode(event.target.value.replace(/\D/g, "").slice(0, 6))} placeholder="执行前输入 6 位验证码" /></label> : null}
+                  <div className="form-actions">
+                    <button className="primary-btn" disabled={busy || !selectedServerId} onClick={() => void createRemoteTask()}>
+                      <Terminal size={15} />执行任务
+                    </button>
+                  </div>
+
+                  {selectedServerId && remoteTasks.length > 0 ? (
+                    <>
+                      <div className="section-head"><h3>任务历史</h3></div>
+                      <div className="task-list">
+                        {remoteTasks.map((task) => (
+                          <div key={task.id} className="task-item">
+                            <div className="task-header">
+                              <span className={`task-status ${task.status}`}>{task.status}</span>
+                              <code className="task-id">{task.id}</code>
+                              <span className="task-time">{new Date(task.requested_at * 1000).toLocaleString()}</span>
+                            </div>
+                            <div className="task-command">
+                              <strong>{task.command || "脚本执行"}</strong>
+                            </div>
+                            {task.status !== "pending" ? (
+                              <details>
+                                <summary>查看结果</summary>
+                                <pre className="task-result">{task.result}</pre>
+                                {task.exit_code !== null ? <div>退出码: {task.exit_code}</div> : null}
+                              </details>
+                            ) : null}
+                          </div>
+                        ))}
+                      </div>
+                    </>
+                  ) : null}
+                </div>
               ) : tab === "about" ? (
                 <div className="admin-section about-page">
-                  <div className="about-brand"><SiteLogo alt="" width="52" height="52" /><div><strong>NodeFlare</strong><small>基于 Rust、WebAssembly 和 Cloudflare Workers 的服务器监控</small></div></div>
+                  <div className="about-brand"><SiteLogo alt="" width="52" height="52" /><div><strong>NodeFlare</strong><small>基于 Rust、Axum、SQLite / PostgreSQL 与 WebSocket 的服务器监控</small></div></div>
                   <div className="about-rows">
                     <div className="about-row"><span>版本</span><strong>v{VERSION}</strong></div>
                     <div className="about-row"><span>项目地址</span><a href="https://github.com/imengying/NodeFlare" target="_blank" rel="noreferrer">github.com/imengying/NodeFlare<ExternalLink size={13} /></a></div>
@@ -788,11 +979,3 @@ function ThemeOption({ field, value, onChange }: { field: ThemeSettingField; val
 function DataStat({ label, value }: { label: string; value: number | string }) {
   return <div className="data-stat"><span>{label}</span><strong>{value}</strong></div>;
 }
-
-function UsageRow({ label, usage }: { label: string; usage: CloudflareUsage["today"] }) {
-  return <tr><th scope="row">{label}</th><td>{usage.rows_read.toLocaleString()}</td><td>{usage.rows_written.toLocaleString()}</td><td>{usage.workers_requests.toLocaleString()}</td><td>{usage.durable_objects_requests.toLocaleString()}</td><td>{usage.durable_objects_duration.toLocaleString(undefined, { maximumFractionDigits: 2 })}</td></tr>;
-}
-
-function UsageDoBreakdown({ label, usage }: { label: string; usage: CloudflareUsage["today"] }) {
-  return <div><strong>{label}</strong><span>HTTP {usage.durable_objects_http_requests.toLocaleString()}</span><span>休眠唤醒 {usage.durable_objects_hibernation_wakeups.toLocaleString()}</span><span>WS 入站 {usage.durable_objects_inbound_websocket_messages.toLocaleString()}</span><span>WS 出站 {usage.durable_objects_outbound_websocket_messages.toLocaleString()}</span><small>每 {usage.durable_objects_request_billing_ratio} 条入站消息折算 1 次请求</small></div>;
-}
diff --git a/frontend/src/live.ts b/frontend/src/live.ts
index 61c4fa6..dc30d9e 100644
--- a/frontend/src/live.ts
+++ b/frontend/src/live.ts
@@ -1,6 +1,6 @@
 import type { LatencySample, LiveLatencyResult, Server } from "./types";
 
-/** A single Agent report as replayed by the Worker. */
+/** A single Agent report as replayed by the NodeFlare server. */
 export interface LiveSample {
   ts: number;
   data: Partial<Server> & { latency_results?: LiveLatencyResult[] };
diff --git a/frontend/src/styles/admin.css b/frontend/src/styles/admin.css
index a7be045..f9d2629 100644
--- a/frontend/src/styles/admin.css
+++ b/frontend/src/styles/admin.css
@@ -21,6 +21,12 @@
   --admin-active-bg: #e3f3ef;
   --admin-accent: #0c7367; /* 选中底 5.00:1，白底 5.73:1 */
   --admin-accent-border: #0a6e61;
+  --admin-success: #047857;
+  --admin-success-bg: #d1fae5;
+  --admin-warning: #b45309;
+  --admin-warning-bg: #fef3c7;
+  --admin-danger: #b91c1c;
+  --admin-danger-bg: #fee2e2;
 }
 .admin-page.admin-dark, .admin-loading.admin-dark {
   --admin-bg: #0e1112;
@@ -34,6 +40,12 @@
   --admin-active-bg: #173830;
   --admin-accent: #4fd1a8;
   --admin-accent-border: #6ee7b7;
+  --admin-success: #34d399;
+  --admin-success-bg: #064e3b;
+  --admin-warning: #fbbf24;
+  --admin-warning-bg: #451a03;
+  --admin-danger: #f87171;
+  --admin-danger-bg: #450a0a;
   color-scheme: dark;
 }
 
@@ -137,6 +149,16 @@
 .section-title svg { color: var(--primary); }
 .section-subtitle { margin-top: 3px; color: var(--admin-text); font-size: 14px; font-weight: 650; }
 .settings-hint { margin: 0; color: var(--admin-muted); font-size: 12px; line-height: 1.7; }
+.two-factor-panel { display: flex; flex-direction: column; gap: 13px; border: 1px solid var(--admin-border); border-radius: 7px; padding: 14px; background: var(--admin-surface); }
+.two-factor-head { display: flex; align-items: flex-start; justify-content: space-between; gap: 12px; }
+.two-factor-head .section-subtitle { margin: 0 0 3px; }
+.two-factor-status { flex: 0 0 auto; border-radius: 999px; padding: 4px 9px; background: var(--admin-bg); color: var(--admin-muted); font-size: 11px; font-weight: 650; }
+.two-factor-status.enabled { background: var(--admin-success-bg); color: var(--admin-success); }
+.two-factor-setup { display: grid; gap: 11px; }
+.copy-field { display: flex; min-width: 0; align-items: center; gap: 7px; }
+.copy-field input { min-width: 0; font-family: ui-monospace, SFMono-Regular, Consolas, monospace; }
+.two-factor-actions { display: flex; align-items: flex-end; flex-wrap: wrap; gap: 9px; }
+.two-factor-actions label { min-width: min(220px, 100%); flex: 1; }
 
 .data-stat-grid { display: grid; gap: 8px; grid-template-columns: repeat(3, 1fr); }
 .data-stat { display: flex; min-height: 82px; justify-content: center; flex-direction: column; gap: 8px; border: 1px solid var(--admin-border); border-radius: 7px; padding: 12px; background: color-mix(in srgb, var(--foreground) 2%, transparent); }
@@ -335,3 +357,20 @@
   .about-row { align-items: flex-start; flex-direction: column; gap: 5px; }
   .about-row a { max-width: 100%; overflow-wrap: anywhere; }
 }
+
+.task-list { display: flex; flex-direction: column; gap: 12px; margin-top: 16px; }
+.task-item { border: 1px solid var(--admin-border); border-radius: 8px; padding: 14px; background: var(--admin-surface); }
+.task-header { display: flex; align-items: center; gap: 10px; margin-bottom: 8px; flex-wrap: wrap; }
+.task-status { display: inline-block; padding: 3px 10px; border-radius: 999px; font-size: 12px; font-weight: 600; text-transform: uppercase; }
+.task-status.pending { background: var(--admin-warning-bg); color: var(--admin-warning); }
+.task-status.sent { background: color-mix(in srgb, var(--primary) 13%, transparent); color: var(--primary); }
+.task-status.success { background: var(--admin-success-bg); color: var(--admin-success); }
+.task-status.failed { background: var(--admin-danger-bg); color: var(--admin-danger); }
+.task-id { font-size: 11px; color: var(--admin-muted); font-family: ui-monospace, monospace; }
+.task-time { font-size: 12px; color: var(--admin-muted); margin-left: auto; }
+.task-command { margin: 8px 0; }
+.task-command strong { color: var(--admin-text); font-size: 13px; font-family: ui-monospace, monospace; }
+.task-result { background: var(--admin-bg); border: 1px solid var(--admin-border); border-radius: 6px; padding: 12px; font-size: 12px; overflow-x: auto; margin-top: 8px; }
+.task-item details { margin-top: 10px; }
+.task-item summary { cursor: pointer; color: var(--admin-accent); font-size: 13px; font-weight: 500; }
+.task-item summary:hover { text-decoration: underline; }
diff --git a/frontend/src/styles/base.css b/frontend/src/styles/base.css
index dbb1b02..2266b08 100644
--- a/frontend/src/styles/base.css
+++ b/frontend/src/styles/base.css
@@ -38,6 +38,14 @@
   text-rendering: optimizeLegibility;
 }
 
+/* Komari 优化：主题切换时禁用所有过渡动画，避免闪烁 */
+[data-theme-switching] *,
+[data-theme-switching] *::before,
+[data-theme-switching] *::after {
+  transition: none !important;
+  animation: none !important;
+}
+
 .dark {
   --background: #0b0e0f;
   --foreground: #f3f6f5;
diff --git a/frontend/src/transport.ts b/frontend/src/transport.ts
index cb9b820..195ad75 100644
--- a/frontend/src/transport.ts
+++ b/frontend/src/transport.ts
@@ -28,9 +28,9 @@ function endpoint(serverId: string | null): URL {
 
 /**
  * WSS-only live feed. Returns a disposer; the caller owns when the connection
- * starts and stops. Reconnects on close, and asks the Worker to wake online
+ * starts and stops. Reconnects on close, and asks the server to wake online
  * Agents in one batch when the overview connection opens. The socket is
- * dropped while the tab is hidden and re-established on return, so the Worker
+ * dropped while the tab is hidden and re-established on return, so the server
  * only forwards live samples for pages somebody is actually watching; the
  * reconnect also re-arms the overview wake.
  */
diff --git a/frontend/src/types.ts b/frontend/src/types.ts
index aee1447..5209402 100644
--- a/frontend/src/types.ts
+++ b/frontend/src/types.ts
@@ -206,8 +206,8 @@ export interface Server extends ServerSummary {
 export interface AdminServer extends ServerSummary {
   hidden: boolean;
   last_ip: string;
-  ip_v4: string | null;
-  ip_v6: string | null;
+  ip_v4: string;
+  ip_v6: string;
   network_interface: string;
   report_interval: number;
   collect_interval: number;
@@ -280,8 +280,6 @@ export interface Settings extends Omit<Config, "password_client_salt"> {
   offline_alert_minutes: number;
   expiry_alert_days: number;
   traffic_alert_percentage: number;
-  cloudflare_account_id: string;
-  cloudflare_api_token: string;
 }
 
 export interface TelegramSettings {
@@ -317,20 +315,34 @@ export interface DatabaseStats {
   history_rows: number;
 }
 
-interface CloudflareUsagePeriod {
-  rows_read: number;
-  rows_written: number;
-  workers_requests: number;
-  durable_objects_requests: number;
-  durable_objects_http_requests: number;
-  durable_objects_hibernation_wakeups: number;
-  durable_objects_inbound_websocket_messages: number;
-  durable_objects_outbound_websocket_messages: number;
-  durable_objects_request_billing_ratio: number;
-  durable_objects_duration: number;
+export interface TotpStatus {
+  enabled: boolean;
+  has_secret: boolean;
 }
 
-export interface CloudflareUsage {
-  today: CloudflareUsagePeriod;
-  yesterday: CloudflareUsagePeriod;
+export interface TotpSetup {
+  secret: string;
+  uri: string;
+  enabled: boolean;
+}
+
+export interface RemoteTask {
+  id: string;
+  server_id: string;
+  command: string;
+  script: string;
+  status: "pending" | "sent" | "success" | "failed";
+  requested_by: string;
+  requested_at: number;
+  started_at: number | null;
+  completed_at: number | null;
+  result: string;
+  exit_code: number | null;
+}
+
+export interface RemoteTaskInput {
+  server_id: string;
+  command: string;
+  script: string;
+  totp_code: string;
 }
diff --git a/frontend/vite.config.ts b/frontend/vite.config.ts
index 9308568..3d7c418 100644
--- a/frontend/vite.config.ts
+++ b/frontend/vite.config.ts
@@ -6,7 +6,10 @@ export default defineConfig({
   server: {
     port: 5173,
     proxy: {
-      "/api": "http://localhost:8787",
+      "/api": {
+        target: "http://127.0.0.1:8080",
+        ws: true,
+      },
     },
   },
 });
diff --git a/migrations/initial_01.sql b/migrations/initial_01.sql
deleted file mode 100644
index f59e732..0000000
--- a/migrations/initial_01.sql
+++ /dev/null
@@ -1,318 +0,0 @@
-PRAGMA foreign_keys = ON;
-
-CREATE TABLE settings (
-  id INTEGER PRIMARY KEY CHECK(id = 1),
-  value TEXT NOT NULL CHECK(json_valid(value)),
-  updated_at INTEGER NOT NULL
-);
-
-CREATE TABLE servers (
-  id TEXT PRIMARY KEY,
-  name TEXT NOT NULL,
-  region TEXT NOT NULL DEFAULT '',
-  group_name TEXT NOT NULL DEFAULT '默认',
-  tags TEXT NOT NULL DEFAULT '',
-  hidden INTEGER NOT NULL DEFAULT 0,
-  sort_order INTEGER NOT NULL DEFAULT 0,
-  expires_at INTEGER,
-  traffic_limit INTEGER NOT NULL DEFAULT 0,
-  traffic_limit_type TEXT NOT NULL DEFAULT 'sum',
-  price REAL NOT NULL DEFAULT 0,
-  billing_cycle INTEGER NOT NULL DEFAULT 30,
-  currency TEXT NOT NULL DEFAULT 'CNY',
-  auto_renewal INTEGER NOT NULL DEFAULT 0,
-  last_ip TEXT NOT NULL DEFAULT '',
-  network_interface TEXT NOT NULL DEFAULT '',
-  reset_day INTEGER NOT NULL DEFAULT 1,
-  report_interval INTEGER NOT NULL DEFAULT 60,
-  collect_interval INTEGER NOT NULL DEFAULT 1,
-  rx_correction INTEGER NOT NULL DEFAULT 0,
-  tx_correction INTEGER NOT NULL DEFAULT 0,
-  agent_mirror TEXT NOT NULL DEFAULT '',
-  offline_notify_disabled INTEGER NOT NULL DEFAULT 0,
-  auto_update INTEGER NOT NULL DEFAULT 1,
-  token TEXT NOT NULL UNIQUE,
-  created_at INTEGER NOT NULL,
-  updated_at INTEGER NOT NULL
-);
-
-CREATE INDEX idx_servers_sort
-  ON servers(sort_order, created_at);
-
--- 分钟粒度历史。下面三张 metric_* 表结构完全一致，统一由
--- db::metric_history_ddl 生成，src/db.rs 的 metric_history_ddl_matches_migration
--- 负责防止漂移——轮换要在运行时重建 metric_history，DDL 因此在 Rust 里也存了一份。
-CREATE TABLE metric_history (
-  server_id TEXT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
-  timestamp INTEGER NOT NULL,
-  cpu REAL NOT NULL DEFAULT 0,
-  load1 REAL NOT NULL DEFAULT 0,
-  load5 REAL NOT NULL DEFAULT 0,
-  load15 REAL NOT NULL DEFAULT 0,
-  mem_used INTEGER NOT NULL DEFAULT 0,
-  mem_total INTEGER NOT NULL DEFAULT 0,
-  swap_used INTEGER NOT NULL DEFAULT 0,
-  swap_total INTEGER NOT NULL DEFAULT 0,
-  disk_used INTEGER NOT NULL DEFAULT 0,
-  disk_total INTEGER NOT NULL DEFAULT 0,
-  net_in REAL NOT NULL DEFAULT 0,
-  net_out REAL NOT NULL DEFAULT 0,
-  net_rx_total INTEGER NOT NULL DEFAULT 0,
-  net_tx_total INTEGER NOT NULL DEFAULT 0,
-  processes INTEGER NOT NULL DEFAULT 0,
-  tcp_connections INTEGER NOT NULL DEFAULT 0,
-  udp_connections INTEGER NOT NULL DEFAULT 0,
-  gpu_usage REAL NOT NULL DEFAULT 0,
-  disk_read_bps REAL NOT NULL DEFAULT 0,
-  disk_write_bps REAL NOT NULL DEFAULT 0,
-  disk_read_iops REAL NOT NULL DEFAULT 0,
-  disk_write_iops REAL NOT NULL DEFAULT 0,
-  disk_await_ms REAL NOT NULL DEFAULT 0,
-  disk_utilization REAL NOT NULL DEFAULT 0,
-  sample_count INTEGER NOT NULL DEFAULT 1 CHECK(sample_count > 0),
-  latest_timestamp INTEGER NOT NULL,
-  latency_json TEXT NOT NULL DEFAULT '[]' CHECK(json_valid(latency_json)),
-  PRIMARY KEY(server_id, timestamp)
-) WITHOUT ROWID;
-
--- 分钟粒度历史的上一代。保留期靠表轮换而不是 DELETE：DELETE 每删一行计一行
--- D1 写入，DROP TABLE 是页级回收、不计行写入。轮换后当前表是空的，所以近期
--- 读取（<=24h）必须同时读这两张表，两代合起来覆盖 24-48 小时。这里预建空表，
--- 保证 union 读取在首次轮换之前就不会撞上缺表。
-CREATE TABLE metric_history_old (
-  server_id TEXT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
-  timestamp INTEGER NOT NULL,
-  cpu REAL NOT NULL DEFAULT 0,
-  load1 REAL NOT NULL DEFAULT 0,
-  load5 REAL NOT NULL DEFAULT 0,
-  load15 REAL NOT NULL DEFAULT 0,
-  mem_used INTEGER NOT NULL DEFAULT 0,
-  mem_total INTEGER NOT NULL DEFAULT 0,
-  swap_used INTEGER NOT NULL DEFAULT 0,
-  swap_total INTEGER NOT NULL DEFAULT 0,
-  disk_used INTEGER NOT NULL DEFAULT 0,
-  disk_total INTEGER NOT NULL DEFAULT 0,
-  net_in REAL NOT NULL DEFAULT 0,
-  net_out REAL NOT NULL DEFAULT 0,
-  net_rx_total INTEGER NOT NULL DEFAULT 0,
-  net_tx_total INTEGER NOT NULL DEFAULT 0,
-  processes INTEGER NOT NULL DEFAULT 0,
-  tcp_connections INTEGER NOT NULL DEFAULT 0,
-  udp_connections INTEGER NOT NULL DEFAULT 0,
-  gpu_usage REAL NOT NULL DEFAULT 0,
-  disk_read_bps REAL NOT NULL DEFAULT 0,
-  disk_write_bps REAL NOT NULL DEFAULT 0,
-  disk_read_iops REAL NOT NULL DEFAULT 0,
-  disk_write_iops REAL NOT NULL DEFAULT 0,
-  disk_await_ms REAL NOT NULL DEFAULT 0,
-  disk_utilization REAL NOT NULL DEFAULT 0,
-  sample_count INTEGER NOT NULL DEFAULT 1 CHECK(sample_count > 0),
-  latest_timestamp INTEGER NOT NULL,
-  latency_json TEXT NOT NULL DEFAULT '[]' CHECK(json_valid(latency_json)),
-  PRIMARY KEY(server_id, timestamp)
-) WITHOUT ROWID;
-
--- 小时粒度历史。分钟表轮换掉之后的长期留存，按 history_retention_days 删除。
-CREATE TABLE metric_history_hourly (
-  server_id TEXT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
-  timestamp INTEGER NOT NULL,
-  cpu REAL NOT NULL DEFAULT 0,
-  load1 REAL NOT NULL DEFAULT 0,
-  load5 REAL NOT NULL DEFAULT 0,
-  load15 REAL NOT NULL DEFAULT 0,
-  mem_used INTEGER NOT NULL DEFAULT 0,
-  mem_total INTEGER NOT NULL DEFAULT 0,
-  swap_used INTEGER NOT NULL DEFAULT 0,
-  swap_total INTEGER NOT NULL DEFAULT 0,
-  disk_used INTEGER NOT NULL DEFAULT 0,
-  disk_total INTEGER NOT NULL DEFAULT 0,
-  net_in REAL NOT NULL DEFAULT 0,
-  net_out REAL NOT NULL DEFAULT 0,
-  net_rx_total INTEGER NOT NULL DEFAULT 0,
-  net_tx_total INTEGER NOT NULL DEFAULT 0,
-  processes INTEGER NOT NULL DEFAULT 0,
-  tcp_connections INTEGER NOT NULL DEFAULT 0,
-  udp_connections INTEGER NOT NULL DEFAULT 0,
-  gpu_usage REAL NOT NULL DEFAULT 0,
-  disk_read_bps REAL NOT NULL DEFAULT 0,
-  disk_write_bps REAL NOT NULL DEFAULT 0,
-  disk_read_iops REAL NOT NULL DEFAULT 0,
-  disk_write_iops REAL NOT NULL DEFAULT 0,
-  disk_await_ms REAL NOT NULL DEFAULT 0,
-  disk_utilization REAL NOT NULL DEFAULT 0,
-  sample_count INTEGER NOT NULL DEFAULT 1 CHECK(sample_count > 0),
-  latest_timestamp INTEGER NOT NULL,
-  latency_json TEXT NOT NULL DEFAULT '[]' CHECK(json_valid(latency_json)),
-  PRIMARY KEY(server_id, timestamp)
-) WITHOUT ROWID;
-
--- 每台机器最新一次上报的落点。和 metric_history 分开，避免轮换影响实时读取。
-CREATE TABLE server_latest_state (
-  server_id TEXT PRIMARY KEY REFERENCES servers(id) ON DELETE CASCADE,
-  latest_timestamp INTEGER NOT NULL,
-  latest_json TEXT NOT NULL CHECK(json_valid(latest_json)),
-  last_batch_id TEXT NOT NULL DEFAULT ''
-) WITHOUT ROWID;
-
-CREATE TABLE exchange_rate_snapshots (
-  base_currency TEXT PRIMARY KEY,
-  rates_json TEXT NOT NULL,
-  source TEXT NOT NULL,
-  rate_date TEXT NOT NULL,
-  fetched_at INTEGER NOT NULL,
-  attempted_at INTEGER NOT NULL
-);
-
-CREATE TABLE themes (
-  id TEXT PRIMARY KEY,
-  name TEXT NOT NULL,
-  description TEXT NOT NULL DEFAULT '',
-  url TEXT NOT NULL UNIQUE,
-  version TEXT NOT NULL DEFAULT '',
-  created_at INTEGER NOT NULL
-);
-
-CREATE INDEX idx_themes_created
-  ON themes(created_at DESC);
-
-CREATE TABLE latency_tasks (
-  id TEXT PRIMARY KEY,
-  name TEXT NOT NULL,
-  task_type TEXT NOT NULL CHECK(task_type IN ('tcp', 'icmp')),
-  target TEXT NOT NULL,
-  port INTEGER CHECK(port IS NULL OR port BETWEEN 1 AND 65535),
-  interval_seconds INTEGER NOT NULL CHECK(interval_seconds BETWEEN 30 AND 3600),
-  default_enabled INTEGER NOT NULL DEFAULT 0,
-  sort_order INTEGER NOT NULL DEFAULT 0,
-  created_at INTEGER NOT NULL,
-  updated_at INTEGER NOT NULL,
-  CHECK((task_type = 'tcp' AND port IS NOT NULL) OR (task_type = 'icmp' AND port IS NULL))
-);
-
-CREATE TABLE latency_task_servers (
-  task_id TEXT NOT NULL REFERENCES latency_tasks(id) ON DELETE CASCADE,
-  server_id TEXT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
-  assigned_at INTEGER NOT NULL,
-  PRIMARY KEY(task_id, server_id)
-) WITHOUT ROWID;
-
-CREATE INDEX idx_latency_task_servers_server
-  ON latency_task_servers(server_id, task_id);
-
-CREATE TABLE alert_rules (
-  id TEXT PRIMARY KEY,
-  name TEXT NOT NULL,
-  metric TEXT NOT NULL CHECK(metric IN ('cpu', 'memory', 'disk', 'net_in', 'net_out')),
-  threshold REAL NOT NULL CHECK(threshold > 0),
-  duration_minutes INTEGER NOT NULL CHECK(duration_minutes BETWEEN 1 AND 1440),
-  aggregation TEXT NOT NULL CHECK(aggregation IN ('average', 'continuous')),
-  enabled INTEGER NOT NULL DEFAULT 1,
-  created_at INTEGER NOT NULL,
-  updated_at INTEGER NOT NULL
-);
-
-CREATE TABLE alert_rule_servers (
-  rule_id TEXT NOT NULL REFERENCES alert_rules(id) ON DELETE CASCADE,
-  server_id TEXT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
-  PRIMARY KEY(rule_id, server_id)
-) WITHOUT ROWID;
-
--- 通知只走 Telegram，单行配置表。
-CREATE TABLE notification_telegram (
-  id INTEGER PRIMARY KEY CHECK(id = 1),
-  bot_token TEXT NOT NULL,
-  chat_id TEXT NOT NULL,
-  message_thread_id INTEGER CHECK(message_thread_id IS NULL OR message_thread_id > 0),
-  template TEXT NOT NULL,
-  updated_at INTEGER NOT NULL
-);
-
-CREATE TABLE notification_events (
-  id TEXT PRIMARY KEY,
-  dedupe_key TEXT NOT NULL UNIQUE,
-  kind TEXT NOT NULL CHECK(kind IN (
-    'offline', 'online', 'expiry', 'resource_alert', 'resource_recovery', 'traffic', 'test'
-  )),
-  server_id TEXT REFERENCES servers(id) ON DELETE SET NULL,
-  server_name TEXT NOT NULL DEFAULT '',
-  title TEXT NOT NULL,
-  message TEXT NOT NULL,
-  details_json TEXT NOT NULL DEFAULT '{}' CHECK(json_valid(details_json)),
-  occurred_at INTEGER NOT NULL,
-  created_at INTEGER NOT NULL
-);
-
-CREATE TABLE notification_deliveries (
-  event_id TEXT PRIMARY KEY REFERENCES notification_events(id) ON DELETE CASCADE,
-  status TEXT NOT NULL CHECK(status IN ('pending', 'sent', 'failed', 'dead')),
-  attempts INTEGER NOT NULL DEFAULT 0,
-  next_attempt_at INTEGER NOT NULL,
-  last_error TEXT,
-  sent_at INTEGER,
-  created_at INTEGER NOT NULL,
-  updated_at INTEGER NOT NULL
-) WITHOUT ROWID;
-
-CREATE INDEX idx_notification_deliveries_pending
-  ON notification_deliveries(status, next_attempt_at, created_at);
-
-CREATE TABLE notification_state (
-  id INTEGER PRIMARY KEY CHECK(id = 1),
-  value TEXT NOT NULL CHECK(json_valid(value)),
-  updated_at INTEGER NOT NULL
-);
-
-INSERT INTO notification_state(id, value, updated_at)
-VALUES (1, '{"offline":[],"expiry":[],"resources":[],"traffic":{}}', unixepoch());
-
-INSERT INTO settings(id, value, updated_at) VALUES (
-  1,
-  json_patch(
-    '{
-      "site_description": "轻量、实时的服务器运行状态",
-      "site_announcement": "",
-      "logo_url": "",
-      "locale": "zh-CN",
-      "public_dashboard": "true",
-      "history_cache_version": "0",
-      "default_theme": "system",
-      "active_theme_id": "builtin-nodeflare-glass",
-      "background_url": "",
-      "theme_options": "{}",
-      "show_search": "true",
-      "show_groups": "true",
-      "show_stats": "true",
-      "show_assets": "true",
-      "show_traffic": "true",
-      "show_speed": "true",
-      "show_price": "true",
-      "show_expiry": "true",
-      "show_latency": "true",
-      "show_uptime": "true",
-      "admin_username": "",
-      "admin_password_hash": "",
-      "turnstile_enabled": "false",
-      "turnstile_login_enabled": "true",
-      "turnstile_site_key": "",
-      "turnstile_secret_key": "",
-      "notification_enabled": "false",
-      "offline_alert_minutes": "5",
-      "expiry_alert_days": "7",
-      "traffic_alert_percentage": "80",
-      "cloudflare_account_id": "",
-      "cloudflare_api_token": ""
-    }',
-    json_object('password_client_salt', lower(hex(randomblob(16))))
-  ),
-  unixepoch()
-);
-
-INSERT INTO exchange_rate_snapshots (
-  base_currency, rates_json, source, rate_date, fetched_at, attempted_at
-) VALUES (
-  'CNY',
-  '{"CNY":1,"USD":0.14799,"CAD":0.2086,"HKD":1.1594,"EUR":0.1275,"GBP":0.11027,"JPY":23.707,"RUB":11.560694,"CHF":0.120661,"INR":14.248668,"VND":3875.968992,"THB":4.97107}',
-  'default', '', 0, 0
-);
-
-PRAGMA optimize;
diff --git a/package.json b/package.json
index 31801f0..0bedb41 100644
--- a/package.json
+++ b/package.json
@@ -8,18 +8,16 @@
     "frontend"
   ],
   "scripts": {
-    "dev": "bun run build:frontend && bun run db:local && NODEFLARE_ADMIN_READY=1 bunx wrangler dev",
+    "dev": "sh dev.sh",
     "dev:frontend": "bun run --cwd frontend dev",
-    "build": "bun run build:frontend && NODEFLARE_ADMIN_READY=1 sh scripts/build-worker.sh",
+    "start": "sh start.sh",
+    "build": "bun run build:frontend && bun run build:backend",
     "build:agent": "sh scripts/build-agent.sh",
+    "build:backend": "sh scripts/build-backend.sh",
     "build:frontend": "sh scripts/build-frontend.sh",
-    "deploy": "sh scripts/deploy-worker.sh",
-    "db:local": "bunx wrangler d1 migrations apply DB --local",
-    "db:remote": "bunx wrangler d1 migrations apply DB --remote",
     "test:smoke": "sh scripts/smoke-test.sh"
   },
   "devDependencies": {
-    "wrangler": "^4.127.0",
     "ws": "^8.21.3"
   },
   "overrides": {
diff --git a/scripts/build-agent.sh b/scripts/build-agent.sh
index 6fb123a..c082275 100644
--- a/scripts/build-agent.sh
+++ b/scripts/build-agent.sh
@@ -4,8 +4,7 @@ set -eu
 script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 root_dir=$(CDPATH= cd -- "$script_dir/.." && pwd)
 NODEFLARE_VERSION=$(sh "$script_dir/resolve-version.sh")
-NODEFLARE_NATIVE_RUST_ONLY=1
-export NODEFLARE_NATIVE_RUST_ONLY NODEFLARE_VERSION
+export NODEFLARE_VERSION
 cd "$root_dir"
 . "$script_dir/ensure-rust.sh"
 
diff --git a/scripts/build-backend.sh b/scripts/build-backend.sh
new file mode 100755
index 0000000..d5ddda3
--- /dev/null
+++ b/scripts/build-backend.sh
@@ -0,0 +1,11 @@
+#!/bin/sh
+set -eu
+
+script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+root_dir=$(CDPATH= cd -- "$script_dir/.." && pwd)
+NODEFLARE_VERSION=$(sh "$script_dir/resolve-version.sh")
+export NODEFLARE_VERSION
+cd "$root_dir"
+. "$script_dir/ensure-rust.sh"
+
+cargo build --manifest-path backend/Cargo.toml --release --locked
diff --git a/scripts/build-frontend.sh b/scripts/build-frontend.sh
index 677f7a9..603d8ce 100644
--- a/scripts/build-frontend.sh
+++ b/scripts/build-frontend.sh
@@ -8,6 +8,7 @@ VITE_NODEFLARE_VERSION=$NODEFLARE_VERSION
 export VITE_NODEFLARE_VERSION
 cd "$root_dir"
 
+[ -d node_modules ] || bun install --frozen-lockfile
 bun run --cwd frontend build
 
 if build_key=$(sh scripts/build-key.sh frontend 2>/dev/null); then
diff --git a/scripts/build-key.sh b/scripts/build-key.sh
index ff8123e..3f82ba2 100644
--- a/scripts/build-key.sh
+++ b/scripts/build-key.sh
@@ -5,11 +5,11 @@ case "${1:-}" in
   frontend)
     paths="frontend package.json bun.lock scripts/build-frontend.sh scripts/build-key.sh scripts/resolve-version.sh"
     ;;
-  worker)
-    paths="src frontend Cargo.toml Cargo.lock build.rs scripts/build-worker.sh scripts/build-key.sh scripts/resolve-version.sh scripts/worker-shim.js"
+  backend)
+    paths="backend/Cargo.toml backend/Cargo.lock backend/src backend/migrations scripts/build-backend.sh scripts/build-key.sh scripts/resolve-version.sh"
     ;;
   *)
-    echo "usage: $0 frontend|worker" >&2
+    echo "usage: $0 frontend|backend" >&2
     exit 2
     ;;
 esac
diff --git a/scripts/build-worker.sh b/scripts/build-worker.sh
deleted file mode 100644
index 0dd9ce0..0000000
--- a/scripts/build-worker.sh
+++ /dev/null
@@ -1,40 +0,0 @@
-#!/bin/sh
-set -eu
-
-script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
-root_dir=$(CDPATH= cd -- "$script_dir/.." && pwd)
-NODEFLARE_VERSION=$(sh "$script_dir/resolve-version.sh")
-export NODEFLARE_VERSION
-cd "$root_dir"
-
-current_build_key=$(sh scripts/build-key.sh worker 2>/dev/null || true)
-if [ "${NODEFLARE_WORKER_READY:-0}" = "1" ] && [ -n "$current_build_key" ]; then
-  built_build_key=$(sed -n '1p' build/.nodeflare-revision 2>/dev/null || true)
-  if [ "$built_build_key" = "$current_build_key" ] \
-    && [ -f build/index.js ] \
-    && [ -f build/worker/index.wasm ]; then
-    echo "Worker build output is ready; skipping rebuild."
-    exit 0
-  fi
-fi
-
-. "$script_dir/ensure-rust.sh"
-
-if [ "${NODEFLARE_ADMIN_READY:-0}" != "1" ]; then
-  bun run build:frontend
-fi
-
-if command -v worker-build >/dev/null 2>&1; then
-  worker_build="$(command -v worker-build)"
-elif [ -x "${CARGO_HOME:-$HOME/.cargo}/bin/worker-build" ]; then
-  worker_build="${CARGO_HOME:-$HOME/.cargo}/bin/worker-build"
-else
-  cargo install -q "worker-build@^0.8"
-  worker_build="${CARGO_HOME:-$HOME/.cargo}/bin/worker-build"
-fi
-
-CUSTOM_SHIM="$script_dir/worker-shim.js" "$worker_build" --release --no-panic-recovery
-
-if [ -n "$current_build_key" ]; then
-  printf '%s\n' "$current_build_key" > build/.nodeflare-revision
-fi
diff --git a/scripts/deploy-worker.sh b/scripts/deploy-worker.sh
deleted file mode 100644
index 3075285..0000000
--- a/scripts/deploy-worker.sh
+++ /dev/null
@@ -1,100 +0,0 @@
-#!/bin/sh
-set -eu
-
-runtime_secrets_file=""
-
-cleanup() {
-  if [ -n "$runtime_secrets_file" ]; then
-    rm -f "$runtime_secrets_file"
-  fi
-}
-
-trap cleanup EXIT HUP INT TERM
-
-validate_admin_username() {
-  if [ -z "${ADMIN_USERNAME:-}" ]; then
-    echo "ADMIN_USERNAME is required" >&2
-    exit 1
-  fi
-  if [ "${#ADMIN_USERNAME}" -gt 64 ]; then
-    echo "ADMIN_USERNAME must not exceed 64 characters" >&2
-    exit 1
-  fi
-  case "$ADMIN_USERNAME" in
-    *[[:space:]]*)
-      echo "ADMIN_USERNAME must not contain whitespace" >&2
-      exit 1
-      ;;
-  esac
-}
-
-frontend_ready() {
-  build_key=$(sh scripts/build-key.sh frontend 2>/dev/null || true)
-  built_build_key=$(sed -n '1p' frontend/dist/.nodeflare-revision 2>/dev/null || true)
-  [ -n "$build_key" ] \
-    && [ "$built_build_key" = "$build_key" ] \
-    && [ -f frontend/dist/index.html ] \
-    && [ -f frontend/admin-dist/admin.js ]
-}
-
-worker_ready() {
-  build_key=$(sh scripts/build-key.sh worker 2>/dev/null || true)
-  built_build_key=$(sed -n '1p' build/.nodeflare-revision 2>/dev/null || true)
-  [ -n "$build_key" ] \
-    && [ "$built_build_key" = "$build_key" ] \
-    && [ -f build/index.js ] \
-    && [ -f build/worker/index.wasm ]
-}
-
-prepare_runtime_secrets() {
-  runtime_secrets_file=$(mktemp)
-  RUNTIME_SECRETS_FILE="$runtime_secrets_file" bun -e '
-    const names = ["ADMIN_PASSWORD", "TURNSTILE_SECRET_KEY", "CF_USAGE_API_TOKEN"];
-    const secrets = Object.fromEntries(
-      names.flatMap((name) => process.env[name] ? [[name, process.env[name]]] : []),
-    );
-    if (Object.keys(secrets).length > 0) {
-      await Bun.write(process.env.RUNTIME_SECRETS_FILE, JSON.stringify(secrets));
-    }
-  '
-
-  if [ ! -s "$runtime_secrets_file" ]; then
-    rm -f "$runtime_secrets_file"
-    runtime_secrets_file=""
-  fi
-}
-
-deploy_worker() {
-  set -- bunx wrangler deploy
-  set -- "$@" --var "ADMIN_USERNAME:${ADMIN_USERNAME}"
-  [ -z "${SITE_NAME:-}" ] || set -- "$@" --var "SITE_NAME:${SITE_NAME}"
-  [ -z "${TURNSTILE_SITE_KEY:-}" ] || set -- "$@" --var "TURNSTILE_SITE_KEY:${TURNSTILE_SITE_KEY}"
-  [ -z "${OFFLINE_THRESHOLD_SECONDS:-}" ] || set -- "$@" --var "OFFLINE_THRESHOLD_SECONDS:${OFFLINE_THRESHOLD_SECONDS}"
-  [ -z "${HISTORY_RETENTION_DAYS:-}" ] || set -- "$@" --var "HISTORY_RETENTION_DAYS:${HISTORY_RETENTION_DAYS}"
-  [ -z "${CF_USAGE_ACCOUNT_ID:-}" ] || set -- "$@" --var "CF_USAGE_ACCOUNT_ID:${CF_USAGE_ACCOUNT_ID}"
-  [ -z "$runtime_secrets_file" ] || set -- "$@" --secrets-file "$runtime_secrets_file"
-  if worker_ready; then
-    NODEFLARE_ADMIN_READY=1 NODEFLARE_WORKER_READY=1 "$@"
-  else
-    NODEFLARE_ADMIN_READY=1 "$@"
-  fi
-}
-
-validate_admin_username
-
-if ! frontend_ready; then
-  bun run build:frontend
-fi
-
-prepare_runtime_secrets
-
-# Workers Builds provisions this binding before running the deploy command. A
-# direct first deployment does not, so provision the Worker first when the
-# default database is not present. The first branch uploads only once.
-if bunx wrangler d1 info nodeflare --json >/dev/null 2>&1; then
-  bunx wrangler d1 migrations apply DB --remote
-  deploy_worker
-else
-  deploy_worker
-  bunx wrangler d1 migrations apply DB --remote
-fi
diff --git a/scripts/ensure-rust.sh b/scripts/ensure-rust.sh
index ad28194..31e56ca 100644
--- a/scripts/ensure-rust.sh
+++ b/scripts/ensure-rust.sh
@@ -7,15 +7,9 @@ case ":$PATH:" in
   *) PATH="$rust_bin_dir:$PATH"; export PATH ;;
 esac
 
-wasm_target_ready() {
-  command -v rustc >/dev/null 2>&1 || return 1
-  target_libdir=$(rustc --print target-libdir --target wasm32-unknown-unknown 2>/dev/null) || return 1
-  test -d "$target_libdir"
-}
-
 rust_ready() {
   command -v cargo >/dev/null 2>&1 || return 1
-  [ "${NODEFLARE_NATIVE_RUST_ONLY:-0}" = "1" ] || wasm_target_ready
+  command -v rustc >/dev/null 2>&1
 }
 
 if ! rust_ready; then
@@ -41,9 +35,6 @@ if ! rust_ready; then
     rustup toolchain install stable --profile minimal
     rustup default stable
   fi
-  if [ "${NODEFLARE_NATIVE_RUST_ONLY:-0}" != "1" ]; then
-    rustup target add wasm32-unknown-unknown
-  fi
 fi
 
 if ! rust_ready; then
diff --git a/scripts/resolve-version.sh b/scripts/resolve-version.sh
index 650b047..a936c7d 100755
--- a/scripts/resolve-version.sh
+++ b/scripts/resolve-version.sh
@@ -11,17 +11,6 @@ fi
 if [ -z "$raw" ]; then
   raw=$(git -C "$root_dir" describe --tags --abbrev=0 --match 'v[0-9]*.[0-9]*.[0-9]*' 2>/dev/null || true)
 fi
-if [ -z "$raw" ]; then
-  remote_version=$(
-    git -C "$root_dir" ls-remote --tags --refs origin \
-      'refs/tags/v[0-9]*.[0-9]*.[0-9]*' 2>/dev/null |
-      awk '{ sub(/^refs\/tags\//, "", $2); print $2 }' |
-      grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' |
-      sort -V |
-      tail -n 1
-  ) || remote_version=
-  raw=$remote_version
-fi
 if [ -z "$raw" ]; then
   raw=$(sed -n 's/^[[:space:]]*"version": "\([^"]*\)",*$/\1/p' "$root_dir/package.json" | sed -n '1p')
 fi
diff --git a/scripts/smoke-test.sh b/scripts/smoke-test.sh
index e50f187..5405d7e 100644
--- a/scripts/smoke-test.sh
+++ b/scripts/smoke-test.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 set -eu
 
-MONITOR_BASE_URL=${MONITOR_BASE_URL:-http://127.0.0.1:8787}
+MONITOR_BASE_URL=${MONITOR_BASE_URL:-http://127.0.0.1:8080}
 MONITOR_TURNSTILE_TOKEN=${MONITOR_TURNSTILE_TOKEN:-XXXX.DUMMY.TOKEN.XXXX}
 : "${MONITOR_ADMIN_USERNAME:?Set MONITOR_ADMIN_USERNAME before running the smoke test}"
 : "${MONITOR_ADMIN_PASSWORD:?Set MONITOR_ADMIN_PASSWORD before running the smoke test}"
@@ -17,6 +17,11 @@ request() {
   monitor_curl --fail --location --silent --show-error "$@"
 }
 
+step() {
+  printf 'smoke: %s\n' "$1" >&2
+}
+
+step "bootstrap"
 bootstrap_json=$(request "$MONITOR_BASE_URL/api/bootstrap")
 printf '%s' "$bootstrap_json" | jq -e '.access == "ok" and (.servers | type == "array")' >/dev/null
 config_json=$(printf '%s' "$bootstrap_json" | jq -c '.config')
@@ -28,28 +33,30 @@ const key = await crypto.subtle.importKey("raw", encoder.encode(process.env.NODE
 const bits = await crypto.subtle.deriveBits({ name: "PBKDF2", hash: "SHA-256", iterations: 600000, salt: encoder.encode(`nodeflare:${process.env.NODEFLARE_SALT}`) }, key, 256);
 console.log(Array.from(new Uint8Array(bits), byte => byte.toString(16).padStart(2, "0")).join(""));
 ')
-cross_origin_status=$(monitor_curl --silent --output /dev/null --write-out '%{http_code}' \
-  -H 'Origin: https://not-nodeflare.invalid' "$MONITOR_BASE_URL/api/bootstrap")
-[ "$cross_origin_status" = "403" ]
-
+step "static assets"
+security_headers=$(monitor_curl --silent --show-error --dump-header - --output /dev/null "$MONITOR_BASE_URL/")
+printf '%s' "$security_headers" | grep -qi '^x-content-type-options: nosniff'
+printf '%s' "$security_headers" | grep -qi '^x-frame-options: DENY'
+printf '%s' "$security_headers" | grep -qi "^content-security-policy:.*frame-ancestors 'none'"
 admin_html=$(request "$MONITOR_BASE_URL/admin")
 case "$admin_html" in
   *"/admin-assets/admin.js"*) ;;
   *)
-    echo "Embedded admin script is missing" >&2
+    echo "Admin script is missing" >&2
     exit 1
     ;;
 esac
 case "$admin_html" in
   *"/admin-assets/admin.css"*) ;;
   *)
-    echo "Embedded admin stylesheet is missing" >&2
+    echo "Admin stylesheet is missing" >&2
     exit 1
     ;;
 esac
 request "$MONITOR_BASE_URL/admin-assets/admin.js" | grep -q '管理面板'
 request "$MONITOR_BASE_URL/admin-assets/admin.css" | grep -q 'admin-shell'
 
+step "login and settings"
 login_json=$(request -H 'Content-Type: application/json' \
   --data "$(jq -nc --arg username "$MONITOR_ADMIN_USERNAME" --arg password "$MONITOR_ADMIN_PASSWORD" --arg password_derived "$password_derived" --arg turnstile_token "$MONITOR_TURNSTILE_TOKEN" '{username:$username,password:$password,password_derived:$password_derived,turnstile_token:$turnstile_token}')" \
   "$MONITOR_BASE_URL/api/admin/login")
@@ -78,6 +85,9 @@ server_id=
 latency_task_id=
 alert_rule_id=
 cleanup() {
+  if [ "${MONITOR_KEEP_RESOURCES:-0}" = "1" ]; then
+    return
+  fi
   if [ -n "$alert_rule_id" ]; then
     monitor_curl --silent --show-error -H "Authorization: Bearer $admin_token" \
       -X DELETE "$MONITOR_BASE_URL/api/admin/alert-rules/$alert_rule_id" >/dev/null || true
@@ -93,6 +103,7 @@ cleanup() {
 }
 trap cleanup EXIT
 
+step "admin resources"
 request -H "Authorization: Bearer $admin_token" \
   "$MONITOR_BASE_URL/api/admin/telegram" | \
   jq -e '.telegram == null or (.telegram.bot_token == "********" and (.telegram.chat_id | length > 0))' >/dev/null
@@ -113,6 +124,7 @@ server_json=$(request -H "Authorization: Bearer $admin_token" \
   "$MONITOR_BASE_URL/api/admin/servers")
 server_id=$(printf '%s' "$server_json" | jq -er '.id')
 agent_token=$(printf '%s' "$server_json" | jq -er '.agent_token')
+step "websocket report"
 MONITOR_BASE_URL="$MONITOR_BASE_URL" MONITOR_ADMIN_TOKEN="$admin_token" \
   MONITOR_AGENT_TOKEN="$agent_token" MONITOR_SERVER_ID="$server_id" \
   MONITOR_LATENCY_TASK_ID="$latency_task_id" \
@@ -124,15 +136,16 @@ request -H "Authorization: Bearer $admin_token" \
   "$MONITOR_BASE_URL/api/admin/servers/$server_id/token" | \
   jq -e --arg token "$agent_token" '.agent_token == $token' >/dev/null
 
+step "persisted metrics"
 request -H "Authorization: Bearer $admin_token" "$MONITOR_BASE_URL/api/admin/servers" | \
   jq -e --arg id "$server_id" '.servers | any(.id == $id and .last_ip == "8.8.8.8")' >/dev/null
 
-request -H "Authorization: Bearer $admin_token" "$MONITOR_BASE_URL/api/bootstrap" | jq -e --arg id "$server_id" --arg task_id "$latency_task_id" '.servers | any(.id == $id and .cpu == 18.5 and .gpu_usage == 32.5 and .disk_await_ms == 1.4 and (.gpus | length) == 1 and (.disks | length) == 1 and .disk_used == 21474836480 and .traffic_limit == 107374182400 and .net_rx_total == 2684354560 and .net_tx_total == 1342177280 and .price == 9.9 and (has("last_ip") | not) and (.latency | any(.task_id == $task_id and .latency_ms == 48.4 and .packet_loss == 75)))' >/dev/null
+post_report_bootstrap=$(request -H "Authorization: Bearer $admin_token" "$MONITOR_BASE_URL/api/bootstrap")
+if ! printf '%s' "$post_report_bootstrap" | jq -e --arg id "$server_id" --arg task_id "$latency_task_id" '.servers | any(.id == $id and .cpu == 18.5 and .gpu_usage == 32.5 and .disk_await_ms == 1.4 and (.gpus | length) == 1 and (.disks | length) == 1 and .disk_used == 21474836480 and .traffic_limit == 107374182400 and .net_rx_total == 2684354560 and .net_tx_total == 1342177280 and .price == 9.9 and (has("last_ip") | not) and (.latency | any(.task_id == $task_id and .latency_ms == 48.4 and .packet_loss == 75)))' >/dev/null; then
+  printf '%s' "$post_report_bootstrap" | jq --arg id "$server_id" '.servers[] | select(.id == $id)' >&2
+  exit 1
+fi
 request -H "Authorization: Bearer $admin_token" "$MONITOR_BASE_URL/api/history/$server_id?hours=1" | jq -e '.points | length >= 1 and any(.gpu_usage == 32.5)' >/dev/null
-history_cache_header=$(monitor_curl --silent --dump-header - --output /dev/null \
-  -H "Authorization: Bearer $admin_token" "$MONITOR_BASE_URL/api/history/$server_id?hours=1" | \
-  tr -d '\r' | awk -F ': ' 'tolower($1) == "x-cache" { print $2 }' | tail -1)
-[ "$history_cache_header" = "HIT" ]
 request -H "Authorization: Bearer $admin_token" "$MONITOR_BASE_URL/api/latency/$server_id?hours=1" | jq -e --arg task_id "$latency_task_id" '(.tasks | any(.id == $task_id)) and (.points | any(.task_id == $task_id and .latency_ms > 38.399 and .latency_ms < 38.401 and .packet_loss > 49.999 and .packet_loss < 50.001))' >/dev/null
 
 # An Agent may have already measured a task when the administrator removes its
@@ -141,11 +154,13 @@ request -H "Authorization: Bearer $admin_token" -H 'Content-Type: application/js
   --data '{"name":"Smoke TCP","task_type":"tcp","target":"example.com","port":443,"interval_seconds":60,"default_enabled":true,"server_ids":[]}' \
   "$MONITOR_BASE_URL/api/admin/latency-tasks/$latency_task_id" >/dev/null
 request -H "Authorization: Bearer $admin_token" "$MONITOR_BASE_URL/api/latency/$server_id?hours=1" | jq -e --arg task_id "$latency_task_id" '(.tasks | all(.id != $task_id)) and (.points | all(.task_id != $task_id))' >/dev/null
+step "agent reconfiguration"
 MONITOR_BASE_URL="$MONITOR_BASE_URL" MONITOR_ADMIN_TOKEN="$admin_token" \
   MONITOR_AGENT_TOKEN="$agent_token" MONITOR_SERVER_ID="$server_id" \
   MONITOR_LATENCY_TASK_ID="$latency_task_id" MONITOR_EXPECT_TASK_ASSIGNED=0 \
   MONITOR_CONFIG_ONLY=1 node scripts/websocket-smoke.mjs
 
+step "alerts and visibility"
 alert_rule_json=$(request -H "Authorization: Bearer $admin_token" -H 'Content-Type: application/json' \
   --data "$(jq -nc --arg server_id "$server_id" '{name:"Smoke CPU",metric:"cpu",threshold:80,duration_minutes:5,aggregation:"average",enabled:true,server_ids:[$server_id]}')" \
   "$MONITOR_BASE_URL/api/admin/alert-rules")
diff --git a/scripts/websocket-smoke.mjs b/scripts/websocket-smoke.mjs
index 091b418..703824b 100644
--- a/scripts/websocket-smoke.mjs
+++ b/scripts/websocket-smoke.mjs
@@ -60,7 +60,8 @@ function expectSocketStatus(path, token, statusCode) {
     });
     socket.once("unexpected-response", (_request, response) => {
       clearTimeout(timer);
-      response.resume();
+      response.destroy();
+      socket.terminate();
       if (response.statusCode === statusCode) {
         resolve();
       } else {
diff --git a/scripts/worker-shim.js b/scripts/worker-shim.js
deleted file mode 100644
index f34f0f3..0000000
--- a/scripts/worker-shim.js
+++ /dev/null
@@ -1,48 +0,0 @@
-import * as imports from "./index_bg.js";
-export * from "./index_bg.js";
-import wasmModule from "./index.wasm";
-import { WorkerEntrypoint } from "cloudflare:workers";
-$SNIPPET_JS_IMPORTS
-
-const instance = new WebAssembly.Instance(wasmModule, {
-  "./index_bg.js": imports,
-  $SNIPPET_WASM_IMPORTS
-});
-
-imports.__wbg_set_wasm(instance.exports);
-instance.exports.__wbindgen_start?.();
-
-export { wasmModule };
-
-class Entrypoint extends WorkerEntrypoint {
-  async fetch(request) {
-    let response = imports.fetch(request, this.env, this.ctx);
-    $WAIT_UNTIL_RESPONSE;
-    return await response;
-  }
-
-  async scheduled(event) {
-    return await imports.scheduled(event, this.env, this.ctx);
-  }
-}
-
-const EXCLUDE_EXPORT = [
-  "IntoUnderlyingByteSource",
-  "IntoUnderlyingSink",
-  "IntoUnderlyingSource",
-  "MinifyConfig",
-  "PolishConfig",
-  "R2Range",
-  "RequestRedirect",
-  "fetch",
-  "scheduled",
-  "getMemory",
-];
-
-Object.keys(imports).map((key) => {
-  if (!(EXCLUDE_EXPORT.includes(key) | key.startsWith("__"))) {
-    Entrypoint.prototype[key] = imports[key];
-  }
-});
-
-export default Entrypoint;
diff --git a/src/auth.rs b/src/auth.rs
deleted file mode 100644
index d10ac4b..0000000
--- a/src/auth.rs
+++ /dev/null
@@ -1,334 +0,0 @@
-use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
-use hmac::{Hmac, KeyInit, Mac};
-use pbkdf2::pbkdf2_hmac;
-use serde::{Deserialize, Serialize};
-use sha2::{Digest, Sha256};
-use worker::{
-    js_sys::{Function, Reflect, Uint8Array},
-    wasm_bindgen::{JsCast, JsValue},
-    Date, Env, Request,
-};
-
-pub const ADMIN_SESSION_SECONDS: i64 = 7 * 24 * 60 * 60;
-const TURNSTILE_PROOF_SECONDS: i64 = 60 * 60;
-const THEME_PREVIEW_SECONDS: i64 = 10 * 60;
-const SERVER_PASSWORD_ROUNDS: u32 = 10_000;
-const JWT_HEADER: &str = r#"{"alg":"HS256","typ":"JWT"}"#;
-
-type HmacSha256 = Hmac<Sha256>;
-
-#[derive(Debug, Deserialize, Serialize)]
-struct AdminClaims {
-    sub: String,
-    iat: i64,
-    exp: i64,
-}
-
-pub fn sha256_hex(value: &str) -> String {
-    let digest = Sha256::digest(value.as_bytes());
-    digest.iter().map(|byte| format!("{byte:02x}")).collect()
-}
-
-fn secure_eq(left: &str, right: &str) -> bool {
-    let left = Sha256::digest(left.as_bytes());
-    let right = Sha256::digest(right.as_bytes());
-    left.iter()
-        .zip(right.iter())
-        .fold(0_u8, |diff, (a, b)| diff | (a ^ b))
-        == 0
-}
-
-fn admin_secret(env: &Env) -> Option<String> {
-    env.secret("ADMIN_PASSWORD").ok().map(|v| v.to_string())
-}
-
-fn password_digest(password_derived: &str, salt: &str, rounds: u32) -> String {
-    let mut digest = [0_u8; 32];
-    pbkdf2_hmac::<Sha256>(
-        password_derived.as_bytes(),
-        salt.as_bytes(),
-        rounds,
-        &mut digest,
-    );
-    digest.iter().map(|byte| format!("{byte:02x}")).collect()
-}
-
-pub fn hash_password(password_derived: &str, salt: &str) -> String {
-    format!(
-        "pbkdf2_sha256_client_v1${SERVER_PASSWORD_ROUNDS}${salt}${}",
-        password_digest(password_derived, salt, SERVER_PASSWORD_ROUNDS)
-    )
-}
-
-pub fn random_salt() -> Option<String> {
-    let global = worker::js_sys::global();
-    let crypto = Reflect::get(&global, &JsValue::from_str("crypto")).ok()?;
-    let get_random_values = Reflect::get(&crypto, &JsValue::from_str("getRandomValues"))
-        .ok()?
-        .dyn_into::<Function>()
-        .ok()?;
-    let salt = Uint8Array::new_with_length(16);
-    get_random_values.call1(&crypto, &salt).ok()?;
-    Some(
-        salt.to_vec()
-            .iter()
-            .map(|byte| format!("{byte:02x}"))
-            .collect(),
-    )
-}
-
-fn verify_password_hash(password_derived: &str, encoded: &str) -> bool {
-    let mut parts = encoded.split('$');
-    let Some(algorithm) = parts.next() else {
-        return false;
-    };
-    let Some(rounds) = parts.next().and_then(|value| value.parse::<u32>().ok()) else {
-        return false;
-    };
-    let Some(salt) = parts.next() else {
-        return false;
-    };
-    let Some(expected) = parts.next() else {
-        return false;
-    };
-    if algorithm != "pbkdf2_sha256_client_v1"
-        || rounds != SERVER_PASSWORD_ROUNDS
-        || salt.len() < 32
-        || parts.next().is_some()
-    {
-        return false;
-    }
-    secure_eq(&password_digest(password_derived, salt, rounds), expected)
-}
-
-pub fn verify_credentials(
-    env: &Env,
-    configured_username: &str,
-    password_hash: &str,
-    username: &str,
-    password: &str,
-    password_derived: &str,
-) -> bool {
-    let expected_username = configured_username.trim();
-    let username_valid =
-        !expected_username.is_empty() && secure_eq(expected_username, username.trim());
-    let password_valid = if password_hash.is_empty() {
-        admin_secret(env)
-            .map(|expected| secure_eq(&expected, password))
-            .unwrap_or(false)
-    } else {
-        verify_password_hash(password_derived, password_hash)
-    };
-    username_valid && password_valid
-}
-
-fn signing_secret(env: &Env, password_hash: &str) -> Option<String> {
-    if !password_hash.is_empty() {
-        return Some(password_hash.to_string());
-    }
-    admin_secret(env)
-}
-
-fn create_admin_jwt_with_secret(secret: &str, issued_at: i64) -> Option<String> {
-    let header = URL_SAFE_NO_PAD.encode(JWT_HEADER);
-    let claims = URL_SAFE_NO_PAD.encode(
-        serde_json::to_vec(&AdminClaims {
-            sub: "admin".to_string(),
-            iat: issued_at,
-            exp: issued_at + ADMIN_SESSION_SECONDS,
-        })
-        .ok()?,
-    );
-    let unsigned = format!("{header}.{claims}");
-    let mut mac = HmacSha256::new_from_slice(secret.as_bytes()).ok()?;
-    mac.update(unsigned.as_bytes());
-    let signature = URL_SAFE_NO_PAD.encode(mac.finalize().into_bytes());
-    Some(format!("{unsigned}.{signature}"))
-}
-
-fn verify_admin_jwt(token: &str, secret: &str, now: i64) -> bool {
-    let mut parts = token.split('.');
-    let (Some(header), Some(claims), Some(signature), None) =
-        (parts.next(), parts.next(), parts.next(), parts.next())
-    else {
-        return false;
-    };
-    if header != URL_SAFE_NO_PAD.encode(JWT_HEADER) {
-        return false;
-    }
-    let Ok(signature) = URL_SAFE_NO_PAD.decode(signature) else {
-        return false;
-    };
-    let Ok(mut mac) = HmacSha256::new_from_slice(secret.as_bytes()) else {
-        return false;
-    };
-    mac.update(format!("{header}.{claims}").as_bytes());
-    if mac.verify_slice(&signature).is_err() {
-        return false;
-    }
-    let Ok(payload) = URL_SAFE_NO_PAD.decode(claims) else {
-        return false;
-    };
-    let Ok(claims) = serde_json::from_slice::<AdminClaims>(&payload) else {
-        return false;
-    };
-    claims.sub == "admin"
-        && claims.iat <= now + 60
-        && claims.exp >= now
-        && claims.exp == claims.iat + ADMIN_SESSION_SECONDS
-}
-
-pub fn create_admin_jwt(env: &Env, password_hash: &str) -> Option<String> {
-    let secret = signing_secret(env, password_hash)?;
-    create_admin_jwt_with_secret(&secret, Date::now().as_millis() as i64 / 1000)
-}
-
-pub fn is_admin(req: &Request, env: &Env, password_hash: &str) -> bool {
-    let Some(secret) = signing_secret(env, password_hash) else {
-        return false;
-    };
-    let now = Date::now().as_millis() as i64 / 1000;
-    let bearer_valid = req
-        .headers()
-        .get("Authorization")
-        .ok()
-        .flatten()
-        .is_some_and(|header| {
-            header
-                .strip_prefix("Bearer ")
-                .is_some_and(|token| verify_admin_jwt(token, &secret, now))
-        });
-    if bearer_valid {
-        return true;
-    }
-    req.headers()
-        .get("Cookie")
-        .ok()
-        .flatten()
-        .is_some_and(|cookies| {
-            cookies
-                .split(';')
-                .find_map(|entry| {
-                    let (name, value) = entry.trim().split_once('=')?;
-                    (name == "nodeflare_admin").then_some(value)
-                })
-                .is_some_and(|token| verify_admin_jwt(token, &secret, now))
-        })
-}
-
-pub fn create_turnstile_proof(env: &Env, password_hash: &str) -> Option<String> {
-    let secret = signing_secret(env, password_hash)?;
-    let expires = Date::now().as_millis() as i64 / 1000 + TURNSTILE_PROOF_SECONDS;
-    let signature = sha256_hex(&format!("nodeflare-turnstile:{expires}:{secret}"));
-    Some(format!("{expires}.{signature}"))
-}
-
-pub fn verify_turnstile_proof(value: &str, env: &Env, password_hash: &str) -> bool {
-    let Some(secret) = signing_secret(env, password_hash) else {
-        return false;
-    };
-    let Some((expires_raw, signature)) = value.split_once('.') else {
-        return false;
-    };
-    let Ok(expires) = expires_raw.parse::<i64>() else {
-        return false;
-    };
-    let current = Date::now().as_millis() as i64 / 1000;
-    if expires < current || expires > current + TURNSTILE_PROOF_SECONDS + 60 {
-        return false;
-    }
-    let expected = sha256_hex(&format!("nodeflare-turnstile:{expires}:{secret}"));
-    secure_eq(&expected, signature)
-}
-
-pub fn create_theme_preview_proof(
-    env: &Env,
-    password_hash: &str,
-    theme_id: &str,
-) -> Option<String> {
-    let secret = signing_secret(env, password_hash)?;
-    let expires = Date::now().as_millis() as i64 / 1000 + THEME_PREVIEW_SECONDS;
-    let payload = format!("{theme_id}.{expires}");
-    let mut mac = HmacSha256::new_from_slice(secret.as_bytes()).ok()?;
-    mac.update(format!("nodeflare-theme-preview:{payload}").as_bytes());
-    let signature = URL_SAFE_NO_PAD.encode(mac.finalize().into_bytes());
-    Some(format!("{payload}.{signature}"))
-}
-
-pub fn verify_theme_preview_proof(value: &str, env: &Env, password_hash: &str) -> Option<String> {
-    let secret = signing_secret(env, password_hash)?;
-    let mut parts = value.split('.');
-    let (Some(theme_id), Some(expires), Some(signature), None) =
-        (parts.next(), parts.next(), parts.next(), parts.next())
-    else {
-        return None;
-    };
-    if theme_id.is_empty() || theme_id.len() > 80 || theme_id.contains('/') {
-        return None;
-    }
-    let expires = expires.parse::<i64>().ok()?;
-    let current = Date::now().as_millis() as i64 / 1000;
-    if expires < current || expires > current + THEME_PREVIEW_SECONDS + 60 {
-        return None;
-    }
-    let signature = URL_SAFE_NO_PAD.decode(signature).ok()?;
-    let mut mac = HmacSha256::new_from_slice(secret.as_bytes()).ok()?;
-    mac.update(format!("nodeflare-theme-preview:{theme_id}.{expires}").as_bytes());
-    mac.verify_slice(&signature).ok()?;
-    Some(theme_id.to_string())
-}
-
-pub fn bearer_token(req: &Request) -> Option<String> {
-    req.headers()
-        .get("Authorization")
-        .ok()
-        .flatten()
-        .and_then(|value| value.strip_prefix("Bearer ").map(ToOwned::to_owned))
-}
-
-#[cfg(test)]
-mod tests {
-    use super::{
-        create_admin_jwt_with_secret, hash_password, verify_admin_jwt, verify_password_hash,
-        ADMIN_SESSION_SECONDS,
-    };
-
-    #[test]
-    fn hashes_passwords_with_pbkdf2() {
-        let encoded = hash_password(
-            "correct horse battery staple",
-            "0123456789abcdef0123456789abcdef",
-        );
-        assert!(encoded.starts_with("pbkdf2_sha256_client_v1$10000$"));
-        assert!(verify_password_hash(
-            "correct horse battery staple",
-            &encoded
-        ));
-        assert!(!verify_password_hash("wrong", &encoded));
-        assert!(!verify_password_hash(
-            "correct horse battery staple",
-            "sha256$0123456789abcdef0123456789abcdef$invalid"
-        ));
-    }
-
-    #[test]
-    fn signs_and_verifies_admin_jwt() {
-        let issued_at = 1_800_000_000;
-        let token = create_admin_jwt_with_secret("d1-password-hash", issued_at).expect("jwt");
-        assert_eq!(token.split('.').count(), 3);
-        assert!(verify_admin_jwt(&token, "d1-password-hash", issued_at + 1));
-        assert!(verify_admin_jwt(
-            &token,
-            "d1-password-hash",
-            issued_at + ADMIN_SESSION_SECONDS
-        ));
-        assert!(!verify_admin_jwt(
-            &token,
-            "d1-password-hash",
-            issued_at + ADMIN_SESSION_SECONDS + 1
-        ));
-        assert!(!verify_admin_jwt(&token, "different-secret", issued_at));
-        let tampered = format!("{}x", token);
-        assert!(!verify_admin_jwt(&tampered, "d1-password-hash", issued_at));
-    }
-}
diff --git a/src/cloudflare.rs b/src/cloudflare.rs
deleted file mode 100644
index 5fbb060..0000000
--- a/src/cloudflare.rs
+++ /dev/null
@@ -1,430 +0,0 @@
-use std::time::Duration;
-
-use serde::{Deserialize, Serialize};
-use worker::{wasm_bindgen::JsValue, Headers, Method, Request, RequestInit, Result};
-
-use crate::outbound::{fetch_with_timeout, read_json_limited};
-
-const GRAPHQL_URL: &str = "https://api.cloudflare.com/client/v4/graphql";
-const GRAPHQL_TIMEOUT: Duration = Duration::from_secs(10);
-const GRAPHQL_MAX_BYTES: usize = 1024 * 1024;
-const DURABLE_OBJECTS_WEBSOCKET_MESSAGE_BILLING_RATIO: i64 = 20;
-const USAGE_QUERY: &str = r#"
-query CloudflareUsage(
-  $accountTag: string!,
-  $start: Date,
-  $end: Date,
-  $startTime: Time!,
-  $endTime: Time!
-) {
-  viewer {
-    accounts(filter: { accountTag: $accountTag }) {
-      d1AnalyticsAdaptiveGroups(
-        limit: 10000,
-        filter: { date_geq: $start, date_leq: $end }
-      ) {
-        sum { rowsRead rowsWritten }
-      }
-      workersInvocationsAdaptive(
-        limit: 10000,
-        filter: { datetime_geq: $startTime, datetime_leq: $endTime }
-      ) {
-        sum { requests }
-      }
-      durableObjectsInvocationsAdaptiveGroups(
-        limit: 10000,
-        filter: { date_geq: $start, date_leq: $end }
-      ) {
-        sum { requests }
-        dimensions { type }
-      }
-      durableObjectsPeriodicGroups(
-        limit: 10000,
-        filter: { date_geq: $start, date_leq: $end }
-      ) {
-        sum { duration inboundWebsocketMsgCount outboundWebsocketMsgCount }
-      }
-    }
-  }
-}
-"#;
-
-#[derive(Debug, Serialize)]
-pub struct UsagePeriod {
-    pub rows_read: i64,
-    pub rows_written: i64,
-    pub workers_requests: i64,
-    pub durable_objects_requests: i64,
-    pub durable_objects_http_requests: i64,
-    pub durable_objects_hibernation_wakeups: i64,
-    pub durable_objects_inbound_websocket_messages: i64,
-    pub durable_objects_outbound_websocket_messages: i64,
-    pub durable_objects_request_billing_ratio: i64,
-    pub durable_objects_duration: f64,
-}
-
-#[derive(Debug, Serialize)]
-pub struct CloudflareUsage {
-    pub today: UsagePeriod,
-    pub yesterday: UsagePeriod,
-}
-
-#[derive(Serialize)]
-struct GraphQlRequest<'a> {
-    query: &'a str,
-    variables: GraphQlVariables<'a>,
-}
-
-#[derive(Serialize)]
-#[serde(rename_all = "camelCase")]
-struct GraphQlVariables<'a> {
-    account_tag: &'a str,
-    start: &'a str,
-    end: &'a str,
-    start_time: &'a str,
-    end_time: &'a str,
-}
-
-#[derive(Deserialize)]
-struct GraphQlResponse {
-    data: Option<GraphQlData>,
-    errors: Option<Vec<GraphQlError>>,
-}
-
-#[derive(Deserialize)]
-struct GraphQlError {
-    message: String,
-}
-
-#[derive(Deserialize)]
-struct GraphQlData {
-    viewer: Viewer,
-}
-
-#[derive(Deserialize)]
-struct Viewer {
-    accounts: Vec<AccountUsage>,
-}
-
-#[derive(Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct AccountUsage {
-    #[serde(default)]
-    d1_analytics_adaptive_groups: Vec<D1Group>,
-    #[serde(default)]
-    workers_invocations_adaptive: Vec<WorkersGroup>,
-    #[serde(default)]
-    durable_objects_invocations_adaptive_groups: Vec<DurableObjectsInvocationGroup>,
-    #[serde(default)]
-    durable_objects_periodic_groups: Vec<DurableObjectsPeriodicGroup>,
-}
-
-#[derive(Deserialize)]
-struct D1Group {
-    sum: D1Sum,
-}
-
-#[derive(Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct D1Sum {
-    #[serde(default)]
-    rows_read: i64,
-    #[serde(default)]
-    rows_written: i64,
-}
-
-#[derive(Deserialize)]
-struct WorkersGroup {
-    sum: WorkersSum,
-}
-
-#[derive(Deserialize)]
-struct WorkersSum {
-    #[serde(default)]
-    requests: i64,
-}
-
-#[derive(Deserialize)]
-struct DurableObjectsInvocationGroup {
-    sum: DurableObjectsInvocationSum,
-    dimensions: DurableObjectsInvocationDimensions,
-}
-
-#[derive(Deserialize)]
-struct DurableObjectsInvocationSum {
-    #[serde(default)]
-    requests: i64,
-}
-
-#[derive(Deserialize)]
-struct DurableObjectsInvocationDimensions {
-    #[serde(rename = "type", default)]
-    invocation_type: String,
-}
-
-#[derive(Deserialize)]
-struct DurableObjectsPeriodicGroup {
-    sum: DurableObjectsPeriodicSum,
-}
-
-#[derive(Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct DurableObjectsPeriodicSum {
-    #[serde(default)]
-    duration: f64,
-    #[serde(default)]
-    inbound_websocket_msg_count: i64,
-    #[serde(default)]
-    outbound_websocket_msg_count: i64,
-}
-
-#[derive(Default)]
-struct DurableObjectsSummary {
-    http_requests: i64,
-    hibernation_wakeups: i64,
-    inbound_websocket_messages: i64,
-    outbound_websocket_messages: i64,
-    billable_requests: i64,
-    duration: f64,
-}
-
-fn is_hibernation_invocation_type(value: &str) -> bool {
-    let normalized = value
-        .chars()
-        .filter(|character| character.is_ascii_alphanumeric())
-        .flat_map(char::to_lowercase)
-        .collect::<String>();
-    normalized.contains("hibernation")
-        || (normalized.contains("websocket") && normalized.contains("message"))
-}
-
-fn ceil_div_nonnegative(value: i64, divisor: i64) -> i64 {
-    if value <= 0 {
-        0
-    } else {
-        value.saturating_add(divisor - 1) / divisor
-    }
-}
-
-fn summarize_durable_objects(
-    invocation_groups: Vec<DurableObjectsInvocationGroup>,
-    periodic_groups: Vec<DurableObjectsPeriodicGroup>,
-) -> DurableObjectsSummary {
-    let mut summary = DurableObjectsSummary::default();
-    for group in invocation_groups {
-        let requests = group.sum.requests.max(0);
-        if is_hibernation_invocation_type(&group.dimensions.invocation_type) {
-            summary.hibernation_wakeups = summary.hibernation_wakeups.saturating_add(requests);
-            // Hibernating WebSocket messages are reported in the invocations
-            // dataset instead of periodic groups. Keep them in the total
-            // inbound count so the 20:1 billing ratio applies to both paths.
-            summary.inbound_websocket_messages =
-                summary.inbound_websocket_messages.saturating_add(requests);
-        } else {
-            summary.http_requests = summary.http_requests.saturating_add(requests);
-        }
-    }
-    for group in periodic_groups {
-        summary.inbound_websocket_messages = summary
-            .inbound_websocket_messages
-            .saturating_add(group.sum.inbound_websocket_msg_count.max(0));
-        summary.outbound_websocket_messages = summary
-            .outbound_websocket_messages
-            .saturating_add(group.sum.outbound_websocket_msg_count.max(0));
-        if group.sum.duration.is_finite() && group.sum.duration > 0.0 {
-            summary.duration += group.sum.duration;
-        }
-    }
-    summary.billable_requests = summary.http_requests.saturating_add(ceil_div_nonnegative(
-        summary.inbound_websocket_messages,
-        DURABLE_OBJECTS_WEBSOCKET_MESSAGE_BILLING_RATIO,
-    ));
-    summary
-}
-
-pub fn date_from_unix_days(days: i64) -> String {
-    let z = days + 719_468;
-    let era = if z >= 0 { z } else { z - 146_096 } / 146_097;
-    let day_of_era = z - era * 146_097;
-    let year_of_era =
-        (day_of_era - day_of_era / 1_460 + day_of_era / 36_524 - day_of_era / 146_096) / 365;
-    let mut year = year_of_era + era * 400;
-    let day_of_year = day_of_era - (365 * year_of_era + year_of_era / 4 - year_of_era / 100);
-    let month_prime = (5 * day_of_year + 2) / 153;
-    let day = day_of_year - (153 * month_prime + 2) / 5 + 1;
-    let month = month_prime + if month_prime < 10 { 3 } else { -9 };
-    year += i64::from(month <= 2);
-    format!("{year:04}-{month:02}-{day:02}")
-}
-
-async fn query_period(token: &str, account_id: &str, date: &str) -> Result<UsagePeriod> {
-    let start_time = format!("{date}T00:00:00Z");
-    let end_time = format!("{date}T23:59:59Z");
-    let body = serde_json::to_string(&GraphQlRequest {
-        query: USAGE_QUERY,
-        variables: GraphQlVariables {
-            account_tag: account_id,
-            start: date,
-            end: date,
-            start_time: &start_time,
-            end_time: &end_time,
-        },
-    })?;
-    let headers = Headers::new();
-    headers.set("Authorization", &format!("Bearer {token}"))?;
-    headers.set("Content-Type", "application/json")?;
-    headers.set("Accept", "application/json")?;
-    let mut init = RequestInit::new();
-    init.with_method(Method::Post)
-        .with_headers(headers)
-        .with_body(Some(JsValue::from_str(&body)));
-    let request = Request::new_with_init(GRAPHQL_URL, &init)?;
-
-    let Some(mut response) = fetch_with_timeout(request, GRAPHQL_TIMEOUT).await? else {
-        return Err(worker::Error::RustError(
-            "Cloudflare GraphQL 请求超时".to_string(),
-        ));
-    };
-    let status = response.status_code();
-    let payload: GraphQlResponse = read_json_limited(&mut response, GRAPHQL_MAX_BYTES).await?;
-    let errors = payload.errors.unwrap_or_default();
-    if !(200..300).contains(&status) || !errors.is_empty() {
-        let message = errors
-            .into_iter()
-            .map(|value| value.message)
-            .collect::<Vec<_>>()
-            .join("; ");
-        return Err(worker::Error::RustError(if message.is_empty() {
-            format!("Cloudflare GraphQL HTTP {status}")
-        } else {
-            message
-        }));
-    }
-    let account = payload
-        .data
-        .and_then(|value| value.viewer.accounts.into_iter().next())
-        .ok_or_else(|| worker::Error::RustError("Cloudflare 账户不可用".to_string()))?;
-    let (rows_read, rows_written) = account.d1_analytics_adaptive_groups.into_iter().fold(
-        (0_i64, 0_i64),
-        |(read, written), group| {
-            (
-                read.saturating_add(group.sum.rows_read),
-                written.saturating_add(group.sum.rows_written),
-            )
-        },
-    );
-    let workers_requests = account
-        .workers_invocations_adaptive
-        .into_iter()
-        .fold(0_i64, |total, group| {
-            total.saturating_add(group.sum.requests)
-        });
-    let durable_objects = summarize_durable_objects(
-        account.durable_objects_invocations_adaptive_groups,
-        account.durable_objects_periodic_groups,
-    );
-    Ok(UsagePeriod {
-        rows_read,
-        rows_written,
-        workers_requests,
-        durable_objects_requests: durable_objects.billable_requests,
-        durable_objects_http_requests: durable_objects.http_requests,
-        durable_objects_hibernation_wakeups: durable_objects.hibernation_wakeups,
-        durable_objects_inbound_websocket_messages: durable_objects.inbound_websocket_messages,
-        durable_objects_outbound_websocket_messages: durable_objects.outbound_websocket_messages,
-        durable_objects_request_billing_ratio: DURABLE_OBJECTS_WEBSOCKET_MESSAGE_BILLING_RATIO,
-        durable_objects_duration: durable_objects.duration,
-    })
-}
-
-pub async fn usage(token: &str, account_id: &str, now: i64) -> Result<CloudflareUsage> {
-    let today = date_from_unix_days(now.div_euclid(86_400));
-    let yesterday = date_from_unix_days(now.div_euclid(86_400) - 1);
-    let (today_usage, yesterday_usage) = futures_util::try_join!(
-        query_period(token, account_id, &today),
-        query_period(token, account_id, &yesterday)
-    )?;
-    Ok(CloudflareUsage {
-        today: today_usage,
-        yesterday: yesterday_usage,
-    })
-}
-
-#[cfg(test)]
-mod tests {
-    use super::{
-        ceil_div_nonnegative, date_from_unix_days, is_hibernation_invocation_type,
-        summarize_durable_objects, DurableObjectsInvocationDimensions,
-        DurableObjectsInvocationGroup, DurableObjectsInvocationSum, DurableObjectsPeriodicGroup,
-        DurableObjectsPeriodicSum, GraphQlResponse,
-    };
-
-    #[test]
-    fn converts_unix_days_to_utc_date() {
-        assert_eq!(date_from_unix_days(0), "1970-01-01");
-        assert_eq!(date_from_unix_days(20_673), "2026-08-08");
-    }
-
-    #[test]
-    fn accepts_null_errors_in_successful_graphql_responses() {
-        let response: GraphQlResponse =
-            serde_json::from_str(r#"{"data":{"viewer":{"accounts":[]}},"errors":null}"#)
-                .expect("Cloudflare GraphQL response");
-        assert!(response.errors.is_none());
-    }
-
-    #[test]
-    fn calculates_durable_objects_billable_requests() {
-        assert!(is_hibernation_invocation_type("webSocketMessage"));
-        assert!(is_hibernation_invocation_type("hibernationWakeup"));
-        assert!(!is_hibernation_invocation_type("fetch"));
-        let summary = summarize_durable_objects(
-            vec![
-                DurableObjectsInvocationGroup {
-                    sum: DurableObjectsInvocationSum { requests: 7 },
-                    dimensions: DurableObjectsInvocationDimensions {
-                        invocation_type: "fetch".to_string(),
-                    },
-                },
-                DurableObjectsInvocationGroup {
-                    sum: DurableObjectsInvocationSum { requests: 3 },
-                    dimensions: DurableObjectsInvocationDimensions {
-                        invocation_type: "webSocketMessage".to_string(),
-                    },
-                },
-            ],
-            vec![DurableObjectsPeriodicGroup {
-                sum: DurableObjectsPeriodicSum {
-                    duration: 2.5,
-                    inbound_websocket_msg_count: 20,
-                    outbound_websocket_msg_count: 11,
-                },
-            }],
-        );
-        assert_eq!(summary.http_requests, 7);
-        assert_eq!(summary.hibernation_wakeups, 3);
-        assert_eq!(summary.inbound_websocket_messages, 23);
-        assert_eq!(summary.billable_requests, 9);
-        assert_eq!(summary.outbound_websocket_messages, 11);
-        assert_eq!(summary.duration, 2.5);
-        assert_eq!(ceil_div_nonnegative(0, 20), 0);
-        assert_eq!(ceil_div_nonnegative(20, 20), 1);
-        assert_eq!(ceil_div_nonnegative(21, 20), 2);
-    }
-
-    #[test]
-    fn bills_hibernating_websocket_messages_at_twenty_to_one() {
-        let summary = summarize_durable_objects(
-            vec![DurableObjectsInvocationGroup {
-                sum: DurableObjectsInvocationSum { requests: 21 },
-                dimensions: DurableObjectsInvocationDimensions {
-                    invocation_type: "webSocketMessage".to_string(),
-                },
-            }],
-            Vec::new(),
-        );
-        assert_eq!(summary.hibernation_wakeups, 21);
-        assert_eq!(summary.inbound_websocket_messages, 21);
-        assert_eq!(summary.billable_requests, 2);
-    }
-}
diff --git a/src/db.rs b/src/db.rs
deleted file mode 100644
index 96cd55d..0000000
--- a/src/db.rs
+++ /dev/null
@@ -1,2016 +0,0 @@
-use std::collections::HashMap;
-
-use serde::{Deserialize, Serialize, Serializer};
-use worker::{wasm_bindgen::JsValue, D1Database, D1PreparedStatement, Date, Result};
-
-use crate::models::{
-    AgentConfigView, AgentIdentityRow, AgentReport, AlertRuleInput, AlertRuleView, HistoryPoint,
-    ServerInput, ServerView, SettingsInput, ThemeInput, ThemeView,
-};
-
-/// 分钟粒度历史的落库间隔。`HistoryMetricAggregate::point` 按分钟取桶，取 60
-/// 让每一分钟都落到自己的桶里，1 小时图表（`history` 里 bucket=60）不再隔一个
-/// 桶空一个。代价是每台每天 1440 行而不是 720 行。
-pub(crate) const HISTORY_WRITE_INTERVAL_SECONDS: i64 = 60;
-pub(crate) const MAX_HISTORY_RETENTION_DAYS: i64 = 30;
-
-/// 分钟粒度历史按天轮换，`metric_history` 的上一代留在 `metric_history_old`。
-/// 轮换而不是 DELETE 的理由：DELETE 每行计一行 D1 写入，DROP TABLE 不计。
-/// 代价是当前表在刚轮换后是空的，所以任何近期读取都必须走 [`RECENT_HISTORY`]。
-pub(crate) const HISTORY_ROTATION_INTERVAL_SECONDS: i64 = 86_400;
-
-/// 分钟粒度历史的读取源。两代合起来覆盖 24-48 小时。
-///
-/// 轮换边界上同一分钟桶可能在两张表里各有一行（当前表刚建好、旧表还留着同
-/// 一分钟的前半段）。所有消费方都按 `sample_count` 加权聚合，两个半行合并后
-/// 与单行等价，所以重复是良性的，不需要去重。
-pub(crate) const RECENT_HISTORY: &str =
-    "SELECT * FROM metric_history UNION ALL SELECT * FROM metric_history_old";
-
-/// `metric_history` 及其轮换副本的表结构，两处必须完全一致。
-///
-/// 轮换要在运行时重建表，所以 DDL 不能只存在于 migration 里。
-/// `metric_history_ddl_matches_migration` 测试比对本函数与 migration 的文本，
-/// 防止两边漂移。
-pub(crate) fn metric_history_ddl(table: &str) -> String {
-    format!(
-        r#"CREATE TABLE {table} (
-  server_id TEXT NOT NULL REFERENCES servers(id) ON DELETE CASCADE,
-  timestamp INTEGER NOT NULL,
-  cpu REAL NOT NULL DEFAULT 0,
-  load1 REAL NOT NULL DEFAULT 0,
-  load5 REAL NOT NULL DEFAULT 0,
-  load15 REAL NOT NULL DEFAULT 0,
-  mem_used INTEGER NOT NULL DEFAULT 0,
-  mem_total INTEGER NOT NULL DEFAULT 0,
-  swap_used INTEGER NOT NULL DEFAULT 0,
-  swap_total INTEGER NOT NULL DEFAULT 0,
-  disk_used INTEGER NOT NULL DEFAULT 0,
-  disk_total INTEGER NOT NULL DEFAULT 0,
-  net_in REAL NOT NULL DEFAULT 0,
-  net_out REAL NOT NULL DEFAULT 0,
-  net_rx_total INTEGER NOT NULL DEFAULT 0,
-  net_tx_total INTEGER NOT NULL DEFAULT 0,
-  processes INTEGER NOT NULL DEFAULT 0,
-  tcp_connections INTEGER NOT NULL DEFAULT 0,
-  udp_connections INTEGER NOT NULL DEFAULT 0,
-  gpu_usage REAL NOT NULL DEFAULT 0,
-  disk_read_bps REAL NOT NULL DEFAULT 0,
-  disk_write_bps REAL NOT NULL DEFAULT 0,
-  disk_read_iops REAL NOT NULL DEFAULT 0,
-  disk_write_iops REAL NOT NULL DEFAULT 0,
-  disk_await_ms REAL NOT NULL DEFAULT 0,
-  disk_utilization REAL NOT NULL DEFAULT 0,
-  sample_count INTEGER NOT NULL DEFAULT 1 CHECK(sample_count > 0),
-  latest_timestamp INTEGER NOT NULL,
-  latency_json TEXT NOT NULL DEFAULT '[]' CHECK(json_valid(latency_json)),
-  PRIMARY KEY(server_id, timestamp)
-) WITHOUT ROWID"#
-    )
-}
-
-const SERVER_SELECT: &str = r#"
-WITH latest_state AS (
-  SELECT s0.id AS server_id, l.latest_json AS state
-  FROM servers s0
-  LEFT JOIN server_latest_state l ON l.server_id = s0.id
-)
-SELECT
-  s.id, s.name, s.region, s.group_name, s.tags, s.hidden,
-  s.expires_at, s.traffic_limit, s.traffic_limit_type,
-  s.price, s.billing_cycle, s.currency, s.auto_renewal,
-  s.last_ip,
-  s.network_interface, s.reset_day, s.report_interval, s.collect_interval,
-  s.rx_correction, s.tx_correction, s.agent_mirror, s.offline_notify_disabled, s.auto_update,
-  s.created_at,
-  CAST(json_extract(m.state, '$.report.timestamp') AS INTEGER) AS timestamp,
-  CAST(json_extract(m.state, '$.report.cpu') AS REAL) AS cpu,
-  CAST(json_extract(m.state, '$.report.load1') AS REAL) AS load1,
-  CAST(json_extract(m.state, '$.report.load5') AS REAL) AS load5,
-  CAST(json_extract(m.state, '$.report.load15') AS REAL) AS load15,
-  CAST(json_extract(m.state, '$.report.mem_used') AS INTEGER) AS mem_used,
-  CAST(json_extract(m.state, '$.report.mem_total') AS INTEGER) AS mem_total,
-  CAST(json_extract(m.state, '$.report.swap_used') AS INTEGER) AS swap_used,
-  CAST(json_extract(m.state, '$.report.swap_total') AS INTEGER) AS swap_total,
-  CAST(json_extract(m.state, '$.report.disk_used') AS INTEGER) AS disk_used,
-  CAST(json_extract(m.state, '$.report.disk_total') AS INTEGER) AS disk_total,
-  CAST(json_extract(m.state, '$.report.net_in') AS REAL) AS net_in,
-  CAST(json_extract(m.state, '$.report.net_out') AS REAL) AS net_out,
-  CASE WHEN m.state IS NULL THEN NULL ELSE MAX(0,
-    CAST(json_extract(m.state, '$.report.net_rx_total') AS INTEGER) + s.rx_correction)
-  END AS net_rx_total,
-  CASE WHEN m.state IS NULL THEN NULL ELSE MAX(0,
-    CAST(json_extract(m.state, '$.report.net_tx_total') AS INTEGER) + s.tx_correction)
-  END AS net_tx_total,
-  CAST(json_extract(m.state, '$.report.uptime') AS INTEGER) AS uptime,
-  CAST(json_extract(m.state, '$.report.processes') AS INTEGER) AS processes,
-  CAST(json_extract(m.state, '$.report.tcp_connections') AS INTEGER) AS tcp_connections,
-  CAST(json_extract(m.state, '$.report.udp_connections') AS INTEGER) AS udp_connections,
-  CAST(json_extract(m.state, '$.report.cpu_cores') AS INTEGER) AS cpu_cores,
-  json_extract(m.state, '$.report.cpu_model') AS cpu_model,
-  json_extract(m.state, '$.report.os') AS os,
-  json_extract(m.state, '$.report.kernel') AS kernel,
-  json_extract(m.state, '$.report.arch') AS arch,
-  json_extract(m.state, '$.report.virtualization') AS virtualization,
-  CAST(json_extract(m.state, '$.report.gpu_usage') AS REAL) AS gpu_usage,
-  json_extract(m.state, '$.report.gpu_model') AS gpu_model,
-  json_extract(m.state, '$.report.agent_version') AS agent_version,
-  json_extract(m.state, '$.report.ip_v4') AS ip_v4,
-  json_extract(m.state, '$.report.ip_v6') AS ip_v6,
-  CAST(json_extract(m.state, '$.report.disk_read_bps') AS REAL) AS disk_read_bps,
-  CAST(json_extract(m.state, '$.report.disk_write_bps') AS REAL) AS disk_write_bps,
-  CAST(json_extract(m.state, '$.report.disk_read_iops') AS REAL) AS disk_read_iops,
-  CAST(json_extract(m.state, '$.report.disk_write_iops') AS REAL) AS disk_write_iops,
-  CAST(json_extract(m.state, '$.report.disk_await_ms') AS REAL) AS disk_await_ms,
-  CAST(json_extract(m.state, '$.report.disk_utilization') AS REAL) AS disk_utilization,
-  json_extract(m.state, '$.report.disks') AS disk_info,
-  json_extract(m.state, '$.report.gpus') AS gpu_info
-FROM servers s
-LEFT JOIN latest_state m ON m.server_id = s.id
-"#;
-
-pub const SECRET_MASK: &str = "********";
-
-fn secret_for_api(value: &str) -> &str {
-    if value.is_empty() {
-        ""
-    } else {
-        SECRET_MASK
-    }
-}
-
-fn serialize_secret<S>(value: &str, serializer: S) -> std::result::Result<S::Ok, S::Error>
-where
-    S: Serializer,
-{
-    serializer.serialize_str(secret_for_api(value))
-}
-
-#[derive(Debug, Deserialize)]
-struct ThemeRow {
-    id: String,
-    name: String,
-    description: String,
-    url: String,
-    version: String,
-}
-
-#[derive(Debug, Deserialize)]
-struct AgentConfigRow {
-    report_interval: i64,
-    collect_interval: i64,
-    network_interface: String,
-    agent_mirror: String,
-    auto_update: i64,
-}
-
-#[derive(Debug, Deserialize)]
-struct ServerIdRow {
-    id: String,
-}
-
-#[derive(Debug, Deserialize)]
-pub struct AgentLiveContext {
-    pub report_interval: i64,
-    pub collect_interval: i64,
-    pub reset_day: i64,
-    pub cycle_key: i64,
-    pub traffic_reset_day: i64,
-    pub traffic_timestamp: i64,
-    pub raw_rx: i64,
-    pub raw_tx: i64,
-    pub used_rx: i64,
-    pub used_tx: i64,
-    pub rx_correction: i64,
-    pub tx_correction: i64,
-    pub last_persisted_at: i64,
-}
-
-#[derive(Debug, Clone, Default, Deserialize, Serialize)]
-pub struct TrafficCounterState {
-    pub cycle_key: i64,
-    pub reset_day: i64,
-    pub timestamp: i64,
-    pub raw_rx: i64,
-    pub raw_tx: i64,
-    pub used_rx: i64,
-    pub used_tx: i64,
-}
-
-#[derive(Debug, Clone, Default, Deserialize, Serialize)]
-pub struct HistoryMetricAggregate {
-    #[serde(rename = "n")]
-    count: u64,
-    #[serde(rename = "t")]
-    timestamp: i64,
-    #[serde(rename = "c")]
-    cpu_sum: f64,
-    #[serde(rename = "a")]
-    load1_sum: f64,
-    #[serde(rename = "b")]
-    load5_sum: f64,
-    #[serde(rename = "d")]
-    load15_sum: f64,
-    #[serde(rename = "m")]
-    mem_used_sum: f64,
-    #[serde(rename = "w")]
-    swap_used_sum: f64,
-    #[serde(rename = "mt")]
-    mem_total: i64,
-    #[serde(rename = "wt")]
-    swap_total: i64,
-    #[serde(rename = "du")]
-    disk_used: i64,
-    #[serde(rename = "dt")]
-    disk_total: i64,
-    #[serde(rename = "nr")]
-    net_rx_total: i64,
-    #[serde(rename = "nt")]
-    net_tx_total: i64,
-    #[serde(rename = "g")]
-    gpu_usage: f64,
-    #[serde(rename = "ni")]
-    net_in: f64,
-    #[serde(rename = "no")]
-    net_out: f64,
-    #[serde(rename = "p")]
-    processes: i64,
-    #[serde(rename = "tc")]
-    tcp_connections: i64,
-    #[serde(rename = "uc")]
-    udp_connections: i64,
-    #[serde(rename = "dr")]
-    disk_read_bps: f64,
-    #[serde(rename = "dw")]
-    disk_write_bps: f64,
-    #[serde(rename = "ri")]
-    disk_read_iops: f64,
-    #[serde(rename = "wi")]
-    disk_write_iops: f64,
-    #[serde(rename = "da")]
-    disk_await_ms: f64,
-    #[serde(rename = "di")]
-    disk_utilization: f64,
-}
-
-impl HistoryMetricAggregate {
-    pub fn extend(&mut self, reports: &[AgentReport]) {
-        for report in reports {
-            self.count = self.count.saturating_add(1);
-            self.cpu_sum += report.cpu;
-            self.load1_sum += report.load1;
-            self.load5_sum += report.load5;
-            self.load15_sum += report.load15;
-            self.mem_used_sum += report.mem_used as f64;
-            self.swap_used_sum += report.swap_used as f64;
-
-            self.net_in = self.net_in.max(report.net_in);
-            self.net_out = self.net_out.max(report.net_out);
-            self.processes = self.processes.max(report.processes);
-            self.tcp_connections = self.tcp_connections.max(report.tcp_connections);
-            self.udp_connections = self.udp_connections.max(report.udp_connections);
-            self.disk_read_bps = self.disk_read_bps.max(report.disk_read_bps);
-            self.disk_write_bps = self.disk_write_bps.max(report.disk_write_bps);
-            self.disk_read_iops = self.disk_read_iops.max(report.disk_read_iops);
-            self.disk_write_iops = self.disk_write_iops.max(report.disk_write_iops);
-            self.disk_await_ms = self.disk_await_ms.max(report.disk_await_ms);
-            self.disk_utilization = self.disk_utilization.max(report.disk_utilization);
-
-            if report.timestamp >= self.timestamp {
-                self.timestamp = report.timestamp;
-                self.mem_total = report.mem_total;
-                self.swap_total = report.swap_total;
-                self.disk_used = report.disk_used;
-                self.disk_total = report.disk_total;
-                self.net_rx_total = report.net_rx_total;
-                self.net_tx_total = report.net_tx_total;
-                self.gpu_usage = report.gpu_usage;
-            }
-        }
-    }
-
-    pub fn merge(&mut self, other: Self) {
-        if other.count == 0 {
-            return;
-        }
-        if self.count == 0 {
-            *self = other;
-            return;
-        }
-
-        self.count = self.count.saturating_add(other.count);
-        self.cpu_sum += other.cpu_sum;
-        self.load1_sum += other.load1_sum;
-        self.load5_sum += other.load5_sum;
-        self.load15_sum += other.load15_sum;
-        self.mem_used_sum += other.mem_used_sum;
-        self.swap_used_sum += other.swap_used_sum;
-        self.net_in = self.net_in.max(other.net_in);
-        self.net_out = self.net_out.max(other.net_out);
-        self.processes = self.processes.max(other.processes);
-        self.tcp_connections = self.tcp_connections.max(other.tcp_connections);
-        self.udp_connections = self.udp_connections.max(other.udp_connections);
-        self.disk_read_bps = self.disk_read_bps.max(other.disk_read_bps);
-        self.disk_write_bps = self.disk_write_bps.max(other.disk_write_bps);
-        self.disk_read_iops = self.disk_read_iops.max(other.disk_read_iops);
-        self.disk_write_iops = self.disk_write_iops.max(other.disk_write_iops);
-        self.disk_await_ms = self.disk_await_ms.max(other.disk_await_ms);
-        self.disk_utilization = self.disk_utilization.max(other.disk_utilization);
-
-        if other.timestamp > self.timestamp {
-            self.timestamp = other.timestamp;
-            self.mem_total = other.mem_total;
-            self.swap_total = other.swap_total;
-            self.disk_used = other.disk_used;
-            self.disk_total = other.disk_total;
-            self.net_rx_total = other.net_rx_total;
-            self.net_tx_total = other.net_tx_total;
-            self.gpu_usage = other.gpu_usage;
-        }
-    }
-
-    pub fn sample_count(&self) -> i64 {
-        self.count.min(i64::MAX as u64) as i64
-    }
-
-    pub fn point(&self) -> Option<HistoryPoint> {
-        if self.count == 0 {
-            return None;
-        }
-        let count = self.count as f64;
-        let rounded_mean = |sum: f64| (sum / count).round() as i64;
-        Some(HistoryPoint {
-            timestamp: self.timestamp / 60 * 60,
-            cpu: self.cpu_sum / count,
-            load1: self.load1_sum / count,
-            load5: self.load5_sum / count,
-            load15: self.load15_sum / count,
-            mem_used: rounded_mean(self.mem_used_sum),
-            mem_total: self.mem_total,
-            swap_used: rounded_mean(self.swap_used_sum),
-            swap_total: self.swap_total,
-            disk_used: self.disk_used,
-            disk_total: self.disk_total,
-            net_in: self.net_in,
-            net_out: self.net_out,
-            net_rx_total: self.net_rx_total,
-            net_tx_total: self.net_tx_total,
-            processes: self.processes,
-            tcp_connections: self.tcp_connections,
-            udp_connections: self.udp_connections,
-            gpu_usage: self.gpu_usage,
-            disk_read_bps: self.disk_read_bps,
-            disk_write_bps: self.disk_write_bps,
-            disk_read_iops: self.disk_read_iops,
-            disk_write_iops: self.disk_write_iops,
-            disk_await_ms: self.disk_await_ms,
-            disk_utilization: self.disk_utilization,
-        })
-    }
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct SettingsView {
-    pub site_name: String,
-    pub site_description: String,
-    pub site_announcement: String,
-    pub logo_url: String,
-    pub locale: String,
-    pub public_dashboard: bool,
-    pub offline_threshold_seconds: i64,
-    pub history_retention_days: i64,
-    #[serde(skip_serializing)]
-    pub history_cache_version: i64,
-    pub default_theme: String,
-    pub active_theme_id: String,
-    pub background_url: String,
-    pub theme_options: serde_json::Value,
-    pub show_search: bool,
-    pub show_groups: bool,
-    pub show_stats: bool,
-    pub show_assets: bool,
-    pub show_traffic: bool,
-    pub show_speed: bool,
-    pub show_price: bool,
-    pub show_expiry: bool,
-    pub show_latency: bool,
-    pub show_uptime: bool,
-    pub admin_username: String,
-    pub admin_password_configured: bool,
-    #[serde(skip_serializing)]
-    pub admin_password_hash: String,
-    #[serde(skip_serializing)]
-    pub password_client_salt: String,
-    pub turnstile_enabled: bool,
-    pub turnstile_login_enabled: bool,
-    #[serde(serialize_with = "serialize_secret")]
-    pub turnstile_site_key: String,
-    #[serde(serialize_with = "serialize_secret")]
-    pub turnstile_secret_key: String,
-    pub notification_enabled: bool,
-    pub offline_alert_minutes: i64,
-    pub expiry_alert_days: i64,
-    pub traffic_alert_percentage: i64,
-    #[serde(serialize_with = "serialize_secret")]
-    pub cloudflare_account_id: String,
-    #[serde(serialize_with = "serialize_secret")]
-    pub cloudflare_api_token: String,
-}
-
-#[derive(Debug, Deserialize, Serialize)]
-pub struct DatabaseStats {
-    pub server_count: i64,
-    pub online_count: i64,
-    pub history_rows: i64,
-}
-
-#[derive(Debug, Clone, Deserialize)]
-pub struct ExchangeRateSnapshot {
-    pub base_currency: String,
-    pub rates_json: String,
-    pub source: String,
-    pub rate_date: String,
-    pub fetched_at: i64,
-    pub attempted_at: i64,
-}
-
-#[derive(Debug, Deserialize)]
-struct AlertRuleRow {
-    id: String,
-    name: String,
-    metric: String,
-    threshold: f64,
-    duration_minutes: i64,
-    aggregation: String,
-    enabled: i64,
-}
-
-#[derive(Debug, Deserialize)]
-struct AlertServerRow {
-    rule_id: String,
-    server_id: String,
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize)]
-pub struct AlertMetricRow {
-    pub server_id: String,
-    pub name: String,
-    pub value: f64,
-    pub sample_count: i64,
-    pub first_timestamp: i64,
-    pub last_timestamp: i64,
-    pub report_interval: i64,
-}
-
-fn now() -> i64 {
-    Date::now().as_millis() as i64 / 1000
-}
-
-fn text(value: &str) -> JsValue {
-    JsValue::from_str(value)
-}
-
-fn number(value: impl ToString) -> JsValue {
-    JsValue::from_f64(value.to_string().parse::<f64>().unwrap_or(0.0))
-}
-
-fn civil_date_from_unix_days(days: i64) -> (i64, i64, i64) {
-    let z = days + 719_468;
-    let era = if z >= 0 { z } else { z - 146_096 } / 146_097;
-    let day_of_era = z - era * 146_097;
-    let year_of_era =
-        (day_of_era - day_of_era / 1_460 + day_of_era / 36_524 - day_of_era / 146_096) / 365;
-    let mut year = year_of_era + era * 400;
-    let day_of_year = day_of_era - (365 * year_of_era + year_of_era / 4 - year_of_era / 100);
-    let month_prime = (5 * day_of_year + 2) / 153;
-    let day = day_of_year - (153 * month_prime + 2) / 5 + 1;
-    let month = month_prime + if month_prime < 10 { 3 } else { -9 };
-    year += i64::from(month <= 2);
-    (year, month, day)
-}
-
-fn days_in_month(year: i64, month: i64) -> i64 {
-    match month {
-        2 if year % 4 == 0 && (year % 100 != 0 || year % 400 == 0) => 29,
-        2 => 28,
-        4 | 6 | 9 | 11 => 30,
-        _ => 31,
-    }
-}
-
-pub(crate) fn traffic_cycle_key(timestamp: i64, reset_day: i64) -> i64 {
-    let (year, month, day) = civil_date_from_unix_days(timestamp.div_euclid(86_400));
-    let boundary = reset_day.clamp(1, 31).min(days_in_month(year, month));
-    let current_month = year * 12 + month - 1;
-    if day >= boundary {
-        current_month
-    } else {
-        current_month - 1
-    }
-}
-
-pub async fn list_servers(db: &D1Database, include_hidden: bool) -> Result<Vec<ServerView>> {
-    let filter = if include_hidden {
-        ""
-    } else {
-        "WHERE s.hidden = 0"
-    };
-    let query = format!("{SERVER_SELECT} {filter} ORDER BY s.sort_order ASC, s.created_at ASC");
-    db.prepare(query).all().await?.results()
-}
-
-/// Returns only requested server IDs that exist and are visible, preserving request order.
-pub async fn visible_server_ids(db: &D1Database, ids: &[String]) -> Result<Vec<String>> {
-    if ids.is_empty() {
-        return Ok(Vec::new());
-    }
-    let requested = serde_json::to_string(ids)?;
-    let rows = db
-        .prepare(
-            r#"SELECT s.id
-               FROM json_each(?1) requested
-               JOIN servers s ON s.id = CAST(requested.value AS TEXT)
-               WHERE s.hidden = 0
-               ORDER BY CAST(requested.key AS INTEGER)"#,
-        )
-        .bind(&[text(&requested)])?
-        .all()
-        .await?
-        .results::<ServerIdRow>()?;
-    Ok(rows.into_iter().map(|row| row.id).collect())
-}
-
-pub async fn get_server(
-    db: &D1Database,
-    id: &str,
-    include_hidden: bool,
-) -> Result<Option<ServerView>> {
-    let hidden = if include_hidden {
-        ""
-    } else {
-        "AND s.hidden = 0"
-    };
-    let query = format!("{SERVER_SELECT} WHERE s.id = ?1 {hidden} LIMIT 1");
-    db.prepare(query).bind(&[text(id)])?.first(None).await
-}
-
-pub async fn get_agent_identity(db: &D1Database, token: &str) -> Result<Option<AgentIdentityRow>> {
-    db.prepare("SELECT id, hidden FROM servers WHERE token = ?1 LIMIT 1")
-        .bind(&[text(token)])?
-        .first(None)
-        .await
-}
-
-pub async fn agent_live_context(db: &D1Database, id: &str) -> Result<Option<AgentLiveContext>> {
-    let mut context: Option<AgentLiveContext> = db
-        .prepare(
-            r#"WITH latest_state AS (
-             SELECT latest_json AS state FROM server_latest_state WHERE server_id = ?1
-           ) SELECT
-             s.report_interval,
-             s.collect_interval,
-             s.reset_day,
-             COALESCE(CAST(json_extract(m.state, '$.traffic.cycle_key') AS INTEGER), 0) AS cycle_key,
-             COALESCE(CAST(json_extract(m.state, '$.traffic.reset_day') AS INTEGER), s.reset_day) AS traffic_reset_day,
-             COALESCE(CAST(json_extract(m.state, '$.traffic.timestamp') AS INTEGER), 0) AS traffic_timestamp,
-             COALESCE(CAST(json_extract(m.state, '$.traffic.raw_rx') AS INTEGER), 0) AS raw_rx,
-             COALESCE(CAST(json_extract(m.state, '$.traffic.raw_tx') AS INTEGER), 0) AS raw_tx,
-             COALESCE(CAST(json_extract(m.state, '$.traffic.used_rx') AS INTEGER), 0) AS used_rx,
-             COALESCE(CAST(json_extract(m.state, '$.traffic.used_tx') AS INTEGER), 0) AS used_tx,
-             s.rx_correction,
-             s.tx_correction,
-             COALESCE(CAST(json_extract(m.state, '$.report.timestamp') AS INTEGER), 0) AS last_persisted_at
-           FROM servers s
-           LEFT JOIN latest_state m ON true
-           WHERE s.id = ?1
-           LIMIT 1"#,
-        )
-        .bind(&[text(id)])?
-        .first(None)
-        .await?;
-    if let Some(context) = context.as_mut() {
-        if context.cycle_key == 0 {
-            context.cycle_key = traffic_cycle_key(crate::now(), context.reset_day);
-        }
-    }
-    Ok(context)
-}
-
-pub async fn get_agent_token(db: &D1Database, id: &str) -> Result<Option<String>> {
-    db.prepare("SELECT token FROM servers WHERE id = ?1 LIMIT 1")
-        .bind(&[text(id)])?
-        .first(Some("token"))
-        .await
-}
-
-pub async fn update_last_ip(db: &D1Database, id: &str, ip: &str) -> Result<()> {
-    db.prepare("UPDATE servers SET last_ip = ?2 WHERE id = ?1 AND last_ip != ?2")
-        .bind(&[text(id), text(ip)])?
-        .run()
-        .await?;
-    Ok(())
-}
-
-pub async fn agent_config(db: &D1Database, id: &str) -> Result<Option<AgentConfigView>> {
-    let row: Option<AgentConfigRow> = db
-        .prepare(
-            "SELECT report_interval, collect_interval, network_interface, agent_mirror, auto_update \
-             FROM servers WHERE id = ?1",
-        )
-        .bind(&[text(id)])?
-        .first(None)
-        .await?;
-    let Some(row) = row else {
-        return Ok(None);
-    };
-    Ok(Some(AgentConfigView {
-        report_interval: row.report_interval,
-        collect_interval: row.collect_interval,
-        network_interface: row.network_interface.trim().to_string(),
-        agent_mirror: row.agent_mirror.trim().trim_end_matches('/').to_string(),
-        auto_update: row.auto_update != 0,
-        latency_tasks: crate::latency::tasks_for_server(db, id).await?,
-    }))
-}
-
-pub async fn create_server(
-    db: &D1Database,
-    id: &str,
-    token: &str,
-    input: &ServerInput,
-) -> Result<()> {
-    let timestamp = now();
-    db.prepare(
-        r#"INSERT INTO servers (
-          id, name, region, group_name, tags, hidden, sort_order,
-          expires_at, traffic_limit, traffic_limit_type, price, billing_cycle,
-          currency, auto_renewal, network_interface, reset_day,
-          report_interval, collect_interval, rx_correction, tx_correction, agent_mirror,
-          offline_notify_disabled, auto_update,
-          token, created_at, updated_at
-        ) VALUES (?1, ?2, ?3, ?4, ?5, ?6,
-          COALESCE((SELECT MAX(sort_order) + 1 FROM servers), 0),
-          ?7, ?8, ?9, ?10, ?11, ?12, ?13, ?14, ?15, ?16, ?17,
-          ?18, ?19, ?20, ?21, ?22, ?23, ?24, ?24)"#,
-    )
-    .bind(&[
-        text(id),
-        text(input.name.trim()),
-        text(input.region.trim()),
-        text(input.group_name.trim()),
-        text(input.tags.trim()),
-        JsValue::from_bool(input.hidden),
-        input.expires_at.map(number).unwrap_or(JsValue::NULL),
-        number(input.traffic_limit),
-        text(input.traffic_limit_type.trim()),
-        number(input.price),
-        number(input.billing_cycle),
-        text(input.currency.trim()),
-        JsValue::from_bool(input.auto_renewal),
-        text(input.network_interface.trim()),
-        number(input.reset_day),
-        number(input.report_interval),
-        number(input.collect_interval),
-        number(input.rx_correction),
-        number(input.tx_correction),
-        text(input.agent_mirror.trim().trim_end_matches('/')),
-        JsValue::from_bool(input.offline_notify_disabled),
-        JsValue::from_bool(input.auto_update),
-        text(token),
-        number(timestamp),
-    ])?
-    .run()
-    .await?;
-    Ok(())
-}
-
-pub async fn update_server(db: &D1Database, id: &str, input: &ServerInput) -> Result<bool> {
-    let result = db
-        .prepare(
-            r#"UPDATE servers SET
-              name = ?2, region = ?3, group_name = ?4, tags = ?5,
-              hidden = ?6, expires_at = ?7, traffic_limit = ?8,
-              traffic_limit_type = ?9, price = ?10, billing_cycle = ?11,
-              currency = ?12, auto_renewal = ?13,
-              network_interface = ?14, reset_day = ?15, report_interval = ?16,
-              collect_interval = ?17, rx_correction = ?18, tx_correction = ?19,
-              agent_mirror = ?20, offline_notify_disabled = ?21, auto_update = ?22, updated_at = ?23
-            WHERE id = ?1"#,
-        )
-        .bind(&[
-            text(id),
-            text(input.name.trim()),
-            text(input.region.trim()),
-            text(input.group_name.trim()),
-            text(input.tags.trim()),
-            JsValue::from_bool(input.hidden),
-            input.expires_at.map(number).unwrap_or(JsValue::NULL),
-            number(input.traffic_limit),
-            text(input.traffic_limit_type.trim()),
-            number(input.price),
-            number(input.billing_cycle),
-            text(input.currency.trim()),
-            JsValue::from_bool(input.auto_renewal),
-            text(input.network_interface.trim()),
-            number(input.reset_day),
-            number(input.report_interval),
-            number(input.collect_interval),
-            number(input.rx_correction),
-            number(input.tx_correction),
-            text(input.agent_mirror.trim().trim_end_matches('/')),
-            JsValue::from_bool(input.offline_notify_disabled),
-            JsValue::from_bool(input.auto_update),
-            number(now()),
-        ])?
-        .run()
-        .await?;
-    Ok(result.meta()?.and_then(|meta| meta.changes).unwrap_or(0) > 0)
-}
-
-pub async fn delete_server(db: &D1Database, id: &str) -> Result<bool> {
-    let result = db
-        .prepare("DELETE FROM servers WHERE id = ?1")
-        .bind(&[text(id)])?
-        .run()
-        .await?;
-    Ok(result.meta()?.and_then(|meta| meta.changes).unwrap_or(0) > 0)
-}
-
-pub async fn delete_servers(db: &D1Database, ids: &[String]) -> Result<()> {
-    let base = db.prepare("DELETE FROM servers WHERE id = ?1");
-    let mut statements = Vec::with_capacity(ids.len());
-    for id in ids {
-        statements.push(base.clone().bind(&[text(id)])?);
-    }
-    if !statements.is_empty() {
-        db.batch(statements).await?;
-    }
-    Ok(())
-}
-
-pub async fn reorder_servers(db: &D1Database, ids: &[String]) -> Result<()> {
-    let base = db.prepare("UPDATE servers SET sort_order = ?2, updated_at = ?3 WHERE id = ?1");
-    let timestamp = now();
-    let mut statements = Vec::with_capacity(ids.len());
-    for (index, id) in ids.iter().enumerate() {
-        statements.push(
-            base.clone()
-                .bind(&[text(id), number(index), number(timestamp)])?,
-        );
-    }
-    if !statements.is_empty() {
-        db.batch(statements).await?;
-    }
-    Ok(())
-}
-
-pub async fn list_alert_rules(db: &D1Database) -> Result<Vec<AlertRuleView>> {
-    let rows: Vec<AlertRuleRow> = db
-        .prepare(
-            "SELECT id, name, metric, threshold, duration_minutes, aggregation, enabled \
-             FROM alert_rules ORDER BY created_at ASC",
-        )
-        .all()
-        .await?
-        .results()?;
-    let assignments: Vec<AlertServerRow> = db
-        .prepare(
-            "SELECT rule_id, server_id FROM alert_rule_servers \
-             ORDER BY rule_id ASC, server_id ASC",
-        )
-        .all()
-        .await?
-        .results()?;
-    let mut servers_by_rule = HashMap::<String, Vec<String>>::new();
-    for assignment in assignments {
-        servers_by_rule
-            .entry(assignment.rule_id)
-            .or_default()
-            .push(assignment.server_id);
-    }
-    let mut rules = Vec::with_capacity(rows.len());
-    for row in rows {
-        let server_ids = servers_by_rule.remove(&row.id).unwrap_or_default();
-        rules.push(AlertRuleView {
-            id: row.id,
-            name: row.name,
-            metric: row.metric,
-            threshold: row.threshold,
-            duration_minutes: row.duration_minutes,
-            aggregation: row.aggregation,
-            enabled: row.enabled != 0,
-            server_ids,
-        });
-    }
-    Ok(rules)
-}
-
-pub async fn has_enabled_alert_rules(db: &D1Database) -> Result<bool> {
-    Ok(db
-        .prepare("SELECT 1 AS present FROM alert_rules WHERE enabled=1 LIMIT 1")
-        .first::<serde_json::Value>(None)
-        .await?
-        .is_some())
-}
-
-fn alert_rule_server_statements(
-    db: &D1Database,
-    rule_id: &str,
-    server_ids: &[String],
-) -> Result<Vec<D1PreparedStatement>> {
-    let mut statements = vec![db
-        .prepare("DELETE FROM alert_rule_servers WHERE rule_id = ?1")
-        .bind(&[text(rule_id)])?];
-    let insert = db.prepare("INSERT INTO alert_rule_servers(rule_id, server_id) VALUES (?1, ?2)");
-    for server_id in server_ids {
-        statements.push(insert.clone().bind(&[text(rule_id), text(server_id)])?);
-    }
-    Ok(statements)
-}
-
-pub async fn create_alert_rule(db: &D1Database, id: &str, input: &AlertRuleInput) -> Result<()> {
-    let timestamp = now();
-    let mut statements = vec![db
-        .prepare(
-            "INSERT INTO alert_rules(id, name, metric, threshold, duration_minutes, \
-         aggregation, enabled, created_at, updated_at) \
-         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?8)",
-        )
-        .bind(&[
-            text(id),
-            text(input.name.trim()),
-            text(input.metric.trim()),
-            number(input.threshold),
-            number(input.duration_minutes),
-            text(input.aggregation.trim()),
-            JsValue::from_bool(input.enabled),
-            number(timestamp),
-        ])?];
-    statements.extend(alert_rule_server_statements(db, id, &input.server_ids)?);
-    db.batch(statements).await?;
-    Ok(())
-}
-
-pub async fn update_alert_rule(db: &D1Database, id: &str, input: &AlertRuleInput) -> Result<bool> {
-    let exists = db
-        .prepare("SELECT 1 AS present FROM alert_rules WHERE id=?1 LIMIT 1")
-        .bind(&[text(id)])?
-        .first::<serde_json::Value>(None)
-        .await?
-        .is_some();
-    if !exists {
-        return Ok(false);
-    }
-    let mut statements = vec![db
-        .prepare(
-            "UPDATE alert_rules SET name=?2, metric=?3, threshold=?4, duration_minutes=?5, \
-         aggregation=?6, enabled=?7, updated_at=?8 WHERE id=?1",
-        )
-        .bind(&[
-            text(id),
-            text(input.name.trim()),
-            text(input.metric.trim()),
-            number(input.threshold),
-            number(input.duration_minutes),
-            text(input.aggregation.trim()),
-            JsValue::from_bool(input.enabled),
-            number(now()),
-        ])?];
-    statements.extend(alert_rule_server_statements(db, id, &input.server_ids)?);
-    db.batch(statements).await?;
-    Ok(true)
-}
-
-pub async fn delete_alert_rule(db: &D1Database, id: &str) -> Result<bool> {
-    let result = db
-        .prepare("DELETE FROM alert_rules WHERE id=?1")
-        .bind(&[text(id)])?
-        .run()
-        .await?;
-    Ok(result.meta()?.and_then(|meta| meta.changes).unwrap_or(0) > 0)
-}
-
-pub(crate) fn alert_window_covered(
-    row: &AlertMetricRow,
-    duration_minutes: i64,
-    current_time: i64,
-) -> bool {
-    let window_seconds = duration_minutes.clamp(1, 1440) * 60;
-    let sample_interval = row
-        .report_interval
-        .clamp(15, 3600)
-        .max(HISTORY_WRITE_INTERVAL_SECONDS);
-    let expected_samples = ((window_seconds + sample_interval - 1) / sample_interval).max(1);
-    let required_samples = if expected_samples == 1 {
-        1
-    } else {
-        ((expected_samples * 3 + 4) / 5).max(2)
-    };
-    let fresh_within = sample_interval * 2;
-    row.sample_count >= required_samples
-        && row.first_timestamp <= row.last_timestamp
-        && current_time.saturating_sub(row.last_timestamp) <= fresh_within
-}
-
-pub async fn history(db: &D1Database, id: &str, hours: i64) -> Result<Vec<HistoryPoint>> {
-    let hours = hours.clamp(1, 24 * 30);
-    let since = now() - hours * 3600;
-    let bucket = match hours {
-        1 => 60,
-        2..=4 => 120,
-        5..=24 => 600,
-        25..=168 => 3600,
-        _ => 14_400,
-    };
-    let source = if hours <= 24 {
-        RECENT_HISTORY.to_string()
-    } else {
-        format!("{RECENT_HISTORY} UNION ALL SELECT * FROM metric_history_hourly")
-    };
-    let query = format!(
-        r#"SELECT
-          (timestamp / {bucket}) * {bucket} AS timestamp,
-          SUM(cpu * sample_count) / SUM(sample_count) AS cpu,
-          SUM(load1 * sample_count) / SUM(sample_count) AS load1,
-          SUM(load5 * sample_count) / SUM(sample_count) AS load5,
-          SUM(load15 * sample_count) / SUM(sample_count) AS load15,
-          CAST(SUM(mem_used * sample_count) / SUM(sample_count) AS INTEGER) AS mem_used,
-          CAST(MAX(mem_total) AS INTEGER) AS mem_total,
-          CAST(SUM(swap_used * sample_count) / SUM(sample_count) AS INTEGER) AS swap_used,
-          CAST(MAX(swap_total) AS INTEGER) AS swap_total,
-          CAST(SUM(disk_used * sample_count) / SUM(sample_count) AS INTEGER) AS disk_used,
-          CAST(MAX(disk_total) AS INTEGER) AS disk_total,
-          MAX(net_in) AS net_in, MAX(net_out) AS net_out,
-          CAST(MAX(net_rx_total) AS INTEGER) AS net_rx_total,
-          CAST(MAX(net_tx_total) AS INTEGER) AS net_tx_total,
-          CAST(MAX(processes) AS INTEGER) AS processes,
-          CAST(MAX(tcp_connections) AS INTEGER) AS tcp_connections,
-          CAST(MAX(udp_connections) AS INTEGER) AS udp_connections,
-          SUM(gpu_usage * sample_count) / SUM(sample_count) AS gpu_usage,
-          MAX(disk_read_bps) AS disk_read_bps,
-          MAX(disk_write_bps) AS disk_write_bps,
-          MAX(disk_read_iops) AS disk_read_iops,
-          MAX(disk_write_iops) AS disk_write_iops,
-          MAX(disk_await_ms) AS disk_await_ms,
-          MAX(disk_utilization) AS disk_utilization
-        FROM ({source})
-        WHERE server_id = ?1 AND timestamp >= ?2
-        GROUP BY timestamp / {bucket}
-        ORDER BY timestamp ASC
-        LIMIT 1000"#,
-    );
-    db.prepare(query)
-        .bind(&[text(id), number(since)])?
-        .all()
-        .await?
-        .results()
-}
-
-pub(crate) fn reports_after(reports: &[AgentReport], timestamp: i64) -> Vec<AgentReport> {
-    reports
-        .iter()
-        .filter(|report| report.timestamp > timestamp)
-        .cloned()
-        .collect()
-}
-
-pub(crate) fn valid_report_batch_id(batch_id: &str) -> bool {
-    !batch_id.is_empty()
-        && batch_id.len() <= 128
-        && batch_id
-            .bytes()
-            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_' | b'.' | b':'))
-}
-
-pub(crate) struct ReportBatchRef<'a> {
-    pub reports: &'a [AgentReport],
-    pub id: &'a str,
-}
-
-pub async fn save_reports_with_history(
-    db: &D1Database,
-    server_id: &str,
-    batch: ReportBatchRef<'_>,
-    history_point: &HistoryPoint,
-    sample_count: i64,
-    traffic: &TrafficCounterState,
-    latency: &crate::latency::LatencyMetricAggregates,
-) -> Result<bool> {
-    let Some(latest_report) = batch.reports.iter().max_by_key(|report| report.timestamp) else {
-        return Ok(false);
-    };
-    let latest_timestamp = latest_report.timestamp;
-    let mut latest_report = latest_report.clone();
-    latest_report.net_rx_total = traffic.used_rx;
-    latest_report.net_tx_total = traffic.used_tx;
-    latest_report.latency_results.clear();
-    let latest_json = serde_json::json!({
-        "report": latest_report,
-        "traffic": traffic,
-    })
-    .to_string();
-    let latency_json = latency.stored_json()?;
-    let batch_id = batch.id;
-    let metric = db.prepare(
-        r#"INSERT INTO metric_history (
-          server_id, timestamp, cpu, load1, load5, load15,
-          mem_used, mem_total, swap_used, swap_total, disk_used, disk_total,
-          net_in, net_out, net_rx_total, net_tx_total, processes,
-          tcp_connections, udp_connections, gpu_usage,
-          disk_read_bps, disk_write_bps, disk_read_iops, disk_write_iops,
-          disk_await_ms, disk_utilization, sample_count,
-          latest_timestamp, latency_json
-        ) SELECT
-          ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13, ?14,
-          ?15, ?16, ?17, ?18, ?19, ?20, ?21, ?22, ?23, ?24, ?25, ?26,
-          ?27, ?28, ?29
-        WHERE NOT EXISTS (
-          SELECT 1 FROM server_latest_state
-          WHERE server_id = ?1 AND last_batch_id = ?30
-        ) ON CONFLICT(server_id, timestamp) DO UPDATE SET
-          cpu=(metric_history.cpu * metric_history.sample_count +
-            excluded.cpu * excluded.sample_count) /
-            (metric_history.sample_count + excluded.sample_count),
-          load1=(metric_history.load1 * metric_history.sample_count +
-            excluded.load1 * excluded.sample_count) /
-            (metric_history.sample_count + excluded.sample_count),
-          load5=(metric_history.load5 * metric_history.sample_count +
-            excluded.load5 * excluded.sample_count) /
-            (metric_history.sample_count + excluded.sample_count),
-          load15=(metric_history.load15 * metric_history.sample_count +
-            excluded.load15 * excluded.sample_count) /
-            (metric_history.sample_count + excluded.sample_count),
-          mem_used=CAST((metric_history.mem_used * metric_history.sample_count +
-            excluded.mem_used * excluded.sample_count) /
-            (metric_history.sample_count + excluded.sample_count) AS INTEGER),
-          mem_total=excluded.mem_total,
-          swap_used=CAST((metric_history.swap_used * metric_history.sample_count +
-            excluded.swap_used * excluded.sample_count) /
-            (metric_history.sample_count + excluded.sample_count) AS INTEGER),
-          swap_total=excluded.swap_total, disk_used=excluded.disk_used,
-          disk_total=excluded.disk_total,
-          net_in=MAX(metric_history.net_in, excluded.net_in),
-          net_out=MAX(metric_history.net_out, excluded.net_out),
-          net_rx_total=excluded.net_rx_total,
-          net_tx_total=excluded.net_tx_total,
-          processes=MAX(metric_history.processes, excluded.processes),
-          tcp_connections=MAX(metric_history.tcp_connections, excluded.tcp_connections),
-          udp_connections=MAX(metric_history.udp_connections, excluded.udp_connections),
-          gpu_usage=excluded.gpu_usage,
-          disk_read_bps=MAX(metric_history.disk_read_bps, excluded.disk_read_bps),
-          disk_write_bps=MAX(metric_history.disk_write_bps, excluded.disk_write_bps),
-          disk_read_iops=MAX(metric_history.disk_read_iops, excluded.disk_read_iops),
-          disk_write_iops=MAX(metric_history.disk_write_iops, excluded.disk_write_iops),
-          disk_await_ms=MAX(metric_history.disk_await_ms, excluded.disk_await_ms),
-          disk_utilization=MAX(metric_history.disk_utilization, excluded.disk_utilization),
-          sample_count=metric_history.sample_count + excluded.sample_count,
-          latest_timestamp=MAX(metric_history.latest_timestamp, excluded.latest_timestamp),
-          latency_json=CASE
-            WHEN json_array_length(excluded.latency_json) = 0 THEN metric_history.latency_json
-            ELSE (
-              WITH latency_rows AS (
-                SELECT
-                  json_extract(value, '$.task_id') AS task_id,
-                  CAST(json_extract(value, '$.timestamp') AS INTEGER) AS timestamp,
-                  CAST(json_extract(value, '$.latency_ms') AS REAL) AS latency_ms,
-                  CAST(json_extract(value, '$.packet_loss') AS REAL) AS packet_loss,
-                  CAST(json_extract(value, '$.sample_count') AS INTEGER) AS sample_count,
-                  CAST(json_extract(value, '$.success_count') AS INTEGER) AS success_count,
-                  CAST(json_extract(value, '$.latest_timestamp') AS INTEGER) AS latest_timestamp,
-                  CAST(json_extract(value, '$.latest_latency_ms') AS REAL) AS latest_latency_ms,
-                  CAST(json_extract(value, '$.latest_packet_loss') AS REAL) AS latest_packet_loss
-                FROM json_each(metric_history.latency_json)
-                UNION ALL
-                SELECT
-                  json_extract(value, '$.task_id'),
-                  CAST(json_extract(value, '$.timestamp') AS INTEGER),
-                  CAST(json_extract(value, '$.latency_ms') AS REAL),
-                  CAST(json_extract(value, '$.packet_loss') AS REAL),
-                  CAST(json_extract(value, '$.sample_count') AS INTEGER),
-                  CAST(json_extract(value, '$.success_count') AS INTEGER),
-                  CAST(json_extract(value, '$.latest_timestamp') AS INTEGER),
-                  CAST(json_extract(value, '$.latest_latency_ms') AS REAL),
-                  CAST(json_extract(value, '$.latest_packet_loss') AS REAL)
-                FROM json_each(excluded.latency_json)
-              ), latency_ranked AS (
-                SELECT *, ROW_NUMBER() OVER (
-                  PARTITION BY task_id ORDER BY latest_timestamp DESC
-                ) AS latest_position
-                FROM latency_rows
-              ), latency_tasks AS (
-                SELECT task_id, MAX(timestamp) AS timestamp,
-                  CASE WHEN SUM(success_count) > 0
-                    THEN SUM(latency_ms * success_count) / SUM(success_count)
-                    ELSE -1 END AS latency_ms,
-                  SUM(packet_loss * sample_count) / SUM(sample_count) AS packet_loss,
-                  SUM(sample_count) AS sample_count,
-                  SUM(success_count) AS success_count,
-                  MAX(CASE WHEN latest_position = 1 THEN latest_timestamp END) AS latest_timestamp,
-                  MAX(CASE WHEN latest_position = 1 THEN latest_latency_ms END) AS latest_latency_ms,
-                  MAX(CASE WHEN latest_position = 1 THEN latest_packet_loss END) AS latest_packet_loss
-                FROM latency_ranked GROUP BY task_id
-              ) SELECT json_group_array(json_object(
-                'task_id', task_id, 'timestamp', timestamp,
-                'latency_ms', latency_ms, 'packet_loss', packet_loss,
-                'sample_count', sample_count, 'success_count', success_count,
-                'latest_timestamp', latest_timestamp,
-                'latest_latency_ms', latest_latency_ms,
-                'latest_packet_loss', latest_packet_loss
-              )) FROM (SELECT * FROM latency_tasks ORDER BY task_id)
-            ) END
-          WHERE excluded.latest_timestamp > metric_history.latest_timestamp"#,
-    );
-    let metric = metric.bind(&[
-        text(server_id),
-        number(history_point.timestamp),
-        number(history_point.cpu),
-        number(history_point.load1),
-        number(history_point.load5),
-        number(history_point.load15),
-        number(history_point.mem_used),
-        number(history_point.mem_total),
-        number(history_point.swap_used),
-        number(history_point.swap_total),
-        number(history_point.disk_used),
-        number(history_point.disk_total),
-        number(history_point.net_in),
-        number(history_point.net_out),
-        number(traffic.used_rx),
-        number(traffic.used_tx),
-        number(history_point.processes),
-        number(history_point.tcp_connections),
-        number(history_point.udp_connections),
-        number(history_point.gpu_usage),
-        number(history_point.disk_read_bps),
-        number(history_point.disk_write_bps),
-        number(history_point.disk_read_iops),
-        number(history_point.disk_write_iops),
-        number(history_point.disk_await_ms),
-        number(history_point.disk_utilization),
-        number(sample_count.max(1)),
-        number(latest_timestamp),
-        text(&latency_json),
-        text(batch_id),
-    ])?;
-    let snapshot = db
-        .prepare(
-            r#"INSERT INTO server_latest_state(
-              server_id, latest_timestamp, latest_json, last_batch_id
-            ) SELECT ?1, ?2, ?3, ?4 WHERE NOT EXISTS (
-              SELECT 1 FROM server_latest_state
-              WHERE server_id=?1 AND last_batch_id=?4
-            ) ON CONFLICT(server_id) DO UPDATE SET
-              latest_timestamp=excluded.latest_timestamp,
-              latest_json=excluded.latest_json,
-              last_batch_id=excluded.last_batch_id
-            WHERE excluded.latest_timestamp >= server_latest_state.latest_timestamp"#,
-        )
-        .bind(&[
-            text(server_id),
-            number(latest_timestamp),
-            text(&latest_json),
-            text(batch_id),
-        ])?;
-    let results = db.batch(vec![metric, snapshot]).await?;
-    Ok(results
-        .first()
-        .and_then(|result| result.meta().ok().flatten())
-        .and_then(|meta| meta.changes)
-        .unwrap_or(0)
-        > 0)
-}
-
-fn bool_setting(values: &HashMap<String, String>, key: &str, fallback: bool) -> bool {
-    values
-        .get(key)
-        .map(|value| value == "true")
-        .unwrap_or(fallback)
-}
-
-fn string_setting(values: &HashMap<String, String>, key: &str, fallback: &str) -> String {
-    values
-        .get(key)
-        .cloned()
-        .unwrap_or_else(|| fallback.to_string())
-}
-
-fn non_empty_string_setting(values: &HashMap<String, String>, key: &str, fallback: &str) -> String {
-    values
-        .get(key)
-        .map(|value| value.trim())
-        .filter(|value| !value.is_empty())
-        .unwrap_or_else(|| fallback.trim())
-        .to_string()
-}
-
-fn integer_setting(values: &HashMap<String, String>, key: &str, fallback: i64) -> i64 {
-    values
-        .get(key)
-        .and_then(|value| value.parse().ok())
-        .unwrap_or(fallback)
-}
-
-pub async fn settings(
-    db: &D1Database,
-    default_name: &str,
-    default_threshold: i64,
-    default_retention: i64,
-    default_username: &str,
-) -> Result<SettingsView> {
-    let raw = db
-        .prepare("SELECT value FROM settings WHERE id = 1")
-        .first::<String>(Some("value"))
-        .await?
-        .ok_or_else(|| worker::Error::RustError("站点设置尚未初始化".to_string()))?;
-    let values: HashMap<String, String> = serde_json::from_str(&raw)
-        .map_err(|_| worker::Error::RustError("站点设置格式无效".to_string()))?;
-    Ok(SettingsView {
-        site_name: values
-            .get("site_name")
-            .cloned()
-            .unwrap_or_else(|| default_name.to_string()),
-        site_description: string_setting(&values, "site_description", "轻量、实时的服务器运行状态"),
-        site_announcement: string_setting(&values, "site_announcement", ""),
-        logo_url: string_setting(&values, "logo_url", ""),
-        locale: string_setting(&values, "locale", "zh-CN"),
-        public_dashboard: bool_setting(&values, "public_dashboard", true),
-        offline_threshold_seconds: values
-            .get("offline_threshold_seconds")
-            .and_then(|value| value.parse().ok())
-            .unwrap_or(default_threshold),
-        history_retention_days: integer_setting(
-            &values,
-            "history_retention_days",
-            default_retention.clamp(1, MAX_HISTORY_RETENTION_DAYS),
-        )
-        .clamp(1, MAX_HISTORY_RETENTION_DAYS),
-        history_cache_version: integer_setting(&values, "history_cache_version", 0),
-        default_theme: string_setting(&values, "default_theme", "system"),
-        active_theme_id: string_setting(&values, "active_theme_id", crate::theme::BUILTIN_THEME_ID),
-        background_url: string_setting(&values, "background_url", ""),
-        theme_options: values
-            .get("theme_options")
-            .and_then(|value| serde_json::from_str(value).ok())
-            .filter(serde_json::Value::is_object)
-            .unwrap_or_else(|| serde_json::json!({})),
-        show_search: bool_setting(&values, "show_search", true),
-        show_groups: bool_setting(&values, "show_groups", true),
-        show_stats: bool_setting(&values, "show_stats", true),
-        show_assets: bool_setting(&values, "show_assets", true),
-        show_traffic: bool_setting(&values, "show_traffic", true),
-        show_speed: bool_setting(&values, "show_speed", true),
-        show_price: bool_setting(&values, "show_price", true),
-        show_expiry: bool_setting(&values, "show_expiry", true),
-        show_latency: bool_setting(&values, "show_latency", true),
-        show_uptime: bool_setting(&values, "show_uptime", true),
-        admin_username: non_empty_string_setting(&values, "admin_username", default_username),
-        admin_password_configured: values
-            .get("admin_password_hash")
-            .is_some_and(|value| !value.is_empty()),
-        admin_password_hash: string_setting(&values, "admin_password_hash", ""),
-        password_client_salt: string_setting(&values, "password_client_salt", ""),
-        turnstile_enabled: bool_setting(&values, "turnstile_enabled", false),
-        turnstile_login_enabled: bool_setting(&values, "turnstile_login_enabled", true),
-        turnstile_site_key: string_setting(&values, "turnstile_site_key", ""),
-        turnstile_secret_key: string_setting(&values, "turnstile_secret_key", ""),
-        notification_enabled: bool_setting(&values, "notification_enabled", false),
-        offline_alert_minutes: integer_setting(&values, "offline_alert_minutes", 5),
-        expiry_alert_days: integer_setting(&values, "expiry_alert_days", 7),
-        traffic_alert_percentage: integer_setting(&values, "traffic_alert_percentage", 80)
-            .clamp(50, 100),
-        cloudflare_account_id: string_setting(&values, "cloudflare_account_id", ""),
-        cloudflare_api_token: string_setting(&values, "cloudflare_api_token", ""),
-    })
-}
-
-pub async fn update_settings(
-    db: &D1Database,
-    input: &SettingsInput,
-    password_hash: Option<&str>,
-) -> Result<()> {
-    let mut updates = Vec::<(&'static str, String)>::new();
-    macro_rules! push_setting {
-        ($key:expr, $value:expr) => {
-            updates.push(($key, $value.to_string()));
-        };
-    }
-
-    if let Some(value) = input.site_name.as_deref() {
-        push_setting!("site_name", value.trim());
-    }
-    if let Some(value) = input.site_description.as_deref() {
-        push_setting!("site_description", value.trim());
-    }
-    if let Some(value) = input.site_announcement.as_deref() {
-        push_setting!("site_announcement", value.trim());
-    }
-    if let Some(value) = input.logo_url.as_deref() {
-        push_setting!("logo_url", value.trim());
-    }
-    if let Some(value) = input.locale.as_deref() {
-        push_setting!("locale", value.trim());
-    }
-    if let Some(value) = input.public_dashboard {
-        push_setting!("public_dashboard", if value { "true" } else { "false" });
-    }
-    if let Some(value) = input.offline_threshold_seconds {
-        let value = value.clamp(30, 3600).to_string();
-        push_setting!("offline_threshold_seconds", &value);
-    }
-    if let Some(value) = input.history_retention_days {
-        let value = value.clamp(1, MAX_HISTORY_RETENTION_DAYS).to_string();
-        push_setting!("history_retention_days", &value);
-    }
-    if let Some(value) = input.default_theme.as_deref() {
-        push_setting!("default_theme", value);
-    }
-    if let Some(value) = input.active_theme_id.as_deref() {
-        push_setting!("active_theme_id", value.trim());
-    }
-    if let Some(value) = input.background_url.as_deref() {
-        push_setting!("background_url", value.trim());
-    }
-    if let Some(value) = input.theme_options.as_ref() {
-        let serialized = value.to_string();
-        push_setting!("theme_options", &serialized);
-    }
-    if let Some(value) = input.show_search {
-        push_setting!("show_search", if value { "true" } else { "false" });
-    }
-    if let Some(value) = input.show_groups {
-        push_setting!("show_groups", if value { "true" } else { "false" });
-    }
-    if let Some(value) = input.show_stats {
-        push_setting!("show_stats", if value { "true" } else { "false" });
-    }
-    if let Some(value) = input.show_assets {
-        push_setting!("show_assets", if value { "true" } else { "false" });
-    }
-    if let Some(value) = input.show_traffic {
-        push_setting!("show_traffic", if value { "true" } else { "false" });
-    }
-    if let Some(value) = input.show_speed {
-        push_setting!("show_speed", if value { "true" } else { "false" });
-    }
-    if let Some(value) = input.show_price {
-        push_setting!("show_price", if value { "true" } else { "false" });
-    }
-    if let Some(value) = input.show_expiry {
-        push_setting!("show_expiry", if value { "true" } else { "false" });
-    }
-    if let Some(value) = input.show_latency {
-        push_setting!("show_latency", if value { "true" } else { "false" });
-    }
-    if let Some(value) = input.show_uptime {
-        push_setting!("show_uptime", if value { "true" } else { "false" });
-    }
-    if let Some(value) = input.admin_username.as_deref() {
-        push_setting!("admin_username", value.trim());
-    }
-    if let Some(value) = password_hash {
-        push_setting!("admin_password_hash", value);
-    }
-    if let Some(value) = input.turnstile_enabled {
-        push_setting!("turnstile_enabled", if value { "true" } else { "false" });
-    }
-    if let Some(value) = input.turnstile_login_enabled {
-        push_setting!(
-            "turnstile_login_enabled",
-            if value { "true" } else { "false" }
-        );
-    }
-    if let Some(value) = input
-        .turnstile_site_key
-        .as_deref()
-        .filter(|value| value.trim() != SECRET_MASK)
-    {
-        push_setting!("turnstile_site_key", value.trim());
-    }
-    if let Some(value) = input
-        .turnstile_secret_key
-        .as_deref()
-        .filter(|value| value.trim() != SECRET_MASK)
-    {
-        push_setting!("turnstile_secret_key", value.trim());
-    }
-    if let Some(value) = input.notification_enabled {
-        push_setting!("notification_enabled", if value { "true" } else { "false" });
-    }
-    if let Some(value) = input.offline_alert_minutes {
-        let value = value.clamp(2, 1440).to_string();
-        push_setting!("offline_alert_minutes", &value);
-    }
-    if let Some(value) = input.expiry_alert_days {
-        let value = value.clamp(0, 365).to_string();
-        push_setting!("expiry_alert_days", &value);
-    }
-    if let Some(value) = input.traffic_alert_percentage {
-        let value = value.clamp(50, 100).to_string();
-        push_setting!("traffic_alert_percentage", &value);
-    }
-    if let Some(value) = input
-        .cloudflare_account_id
-        .as_deref()
-        .filter(|value| value.trim() != SECRET_MASK)
-    {
-        push_setting!("cloudflare_account_id", value.trim());
-    }
-    if let Some(value) = input
-        .cloudflare_api_token
-        .as_deref()
-        .filter(|value| value.trim() != SECRET_MASK)
-    {
-        push_setting!("cloudflare_api_token", value.trim());
-    }
-    if !updates.is_empty() {
-        let patch = updates
-            .into_iter()
-            .map(|(key, value)| (key.to_string(), serde_json::Value::String(value)))
-            .collect::<serde_json::Map<_, _>>();
-        db.prepare("UPDATE settings SET value=json_patch(value, ?1), updated_at=?2 WHERE id=1")
-            .bind(&[
-                text(&serde_json::Value::Object(patch).to_string()),
-                number(now()),
-            ])?
-            .run()
-            .await?;
-    }
-    Ok(())
-}
-
-pub async fn list_themes(db: &D1Database, active_id: &str) -> Result<Vec<ThemeView>> {
-    let rows: Vec<ThemeRow> = db
-        .prepare("SELECT id, name, description, url, version FROM themes ORDER BY created_at DESC")
-        .all()
-        .await?
-        .results()?;
-    Ok(rows
-        .into_iter()
-        .map(|row| {
-            let active = row.id == active_id;
-            ThemeView {
-                id: row.id,
-                name: row.name,
-                description: row.description,
-                url: row.url,
-                version: row.version,
-                builtin: false,
-                active,
-            }
-        })
-        .collect())
-}
-
-pub async fn create_theme(
-    db: &D1Database,
-    id: &str,
-    input: &ThemeInput,
-    source_url: &str,
-    version: &str,
-    timestamp: i64,
-) -> Result<()> {
-    db.prepare(
-        "INSERT INTO themes(id, name, description, url, version, created_at) \
-         VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
-    )
-    .bind(&[
-        text(id),
-        text(input.name.trim()),
-        text(input.description.trim()),
-        text(source_url),
-        text(version),
-        number(timestamp),
-    ])?
-    .run()
-    .await?;
-    Ok(())
-}
-
-pub async fn theme_exists(db: &D1Database, id: &str) -> Result<bool> {
-    let row: Option<ThemeRow> = db
-        .prepare("SELECT id, name, description, url, version FROM themes WHERE id = ?1")
-        .bind(&[text(id)])?
-        .first(None)
-        .await?;
-    Ok(row.is_some())
-}
-
-pub async fn theme_url(db: &D1Database, id: &str) -> Result<Option<String>> {
-    let row: Option<ThemeRow> = db
-        .prepare("SELECT id, name, description, url, version FROM themes WHERE id = ?1")
-        .bind(&[text(id)])?
-        .first(None)
-        .await?;
-    row.map(|theme| crate::theme::resolve_url(&theme.url).map(|resolved| resolved.resolved_url))
-        .transpose()
-}
-
-pub async fn update_theme_version(db: &D1Database, id: &str, version: &str) -> Result<()> {
-    db.prepare("UPDATE themes SET version = ?2 WHERE id = ?1")
-        .bind(&[text(id), text(version)])?
-        .run()
-        .await?;
-    Ok(())
-}
-
-pub async fn set_active_theme(db: &D1Database, id: &str) -> Result<bool> {
-    if id != crate::theme::BUILTIN_THEME_ID && !theme_exists(db, id).await? {
-        return Ok(false);
-    }
-    save_setting(db, "active_theme_id", id).await?;
-    Ok(true)
-}
-
-pub async fn delete_theme(db: &D1Database, id: &str) -> Result<bool> {
-    let result = db
-        .prepare("DELETE FROM themes WHERE id = ?1")
-        .bind(&[text(id)])?
-        .run()
-        .await?;
-    let deleted = result.meta()?.and_then(|meta| meta.changes).unwrap_or(0) > 0;
-    if deleted && get_setting(db, "active_theme_id").await?.as_deref() == Some(id) {
-        save_setting(db, "active_theme_id", crate::theme::BUILTIN_THEME_ID).await?;
-    }
-    Ok(deleted)
-}
-
-/// 把分钟历史压成小时粒度，然后轮换分钟表、按保留期删除过期小时行。
-///
-/// 压缩读两代分钟表，区间是 `[保留期下界, 当前整小时)`，小时表按覆盖语义写入
-/// （不累加，见那条 SQL 里的注释）。三者合起来让压缩天然幂等：
-///
-/// - 读两代保证轮换即将丢弃的行一定已经压过，不需要「哪一代压过了」的状态标记。
-/// - 上界卡在整小时，避免把还在写的小时压进归档。
-/// - 覆盖语义让重复压缩变成重算同一个值，跑几次结果都一样。
-///
-/// 所以这个函数崩在任何一步、下一次 cron 重跑都是对的。
-///
-/// 顺序是「压缩 + 删除过期小时行（同一个 batch）→ 轮换分钟表」。
-///
-/// 调用方（`src/lib.rs` 的 cron）已经把频率限制在一天一次，与
-/// [`HISTORY_ROTATION_INTERVAL_SECONDS`] 一致。分钟数据因此保留 24-48 小时而不
-/// 是精确 24 小时；小时数据仍然精确按 `retention_days` 删除。
-pub async fn cleanup_history(db: &D1Database, retention_days: i64) -> Result<()> {
-    let current = now();
-    let cutoff = history_cutoff(current, retention_days);
-    // 只压已经走完的小时；当前这个未完成的小时留给下一次 cron。
-    let complete_hours_before = current.div_euclid(3600) * 3600;
-    let compact = db
-        .prepare(
-            r#"WITH recent AS (
-          -- 两代分钟表，等价于 db::RECENT_HISTORY。下面 ranked 和 latency_ranked
-          -- 都从这里取，保证指标和延迟压的是同一批源行。
-          SELECT * FROM metric_history UNION ALL SELECT * FROM metric_history_old
-        ), ranked AS (
-          SELECT h.*, (h.timestamp / 3600) * 3600 AS bucket,
-            ROW_NUMBER() OVER (
-              PARTITION BY h.server_id, h.timestamp / 3600
-              ORDER BY latest_timestamp DESC
-            ) AS latest_position
-          FROM recent h
-          WHERE h.timestamp >= ?1 AND h.timestamp < ?2
-        ), metrics AS (
-          SELECT
-            server_id, bucket,
-            SUM(cpu * sample_count) / SUM(sample_count) AS cpu,
-            SUM(load1 * sample_count) / SUM(sample_count) AS load1,
-            SUM(load5 * sample_count) / SUM(sample_count) AS load5,
-            SUM(load15 * sample_count) / SUM(sample_count) AS load15,
-            CAST(SUM(mem_used * sample_count) / SUM(sample_count) AS INTEGER) AS mem_used,
-            MAX(mem_total) AS mem_total,
-            CAST(SUM(swap_used * sample_count) / SUM(sample_count) AS INTEGER) AS swap_used,
-            MAX(swap_total) AS swap_total,
-            CAST(SUM(disk_used * sample_count) / SUM(sample_count) AS INTEGER) AS disk_used,
-            MAX(disk_total) AS disk_total, MAX(net_in) AS net_in, MAX(net_out) AS net_out,
-            MAX(net_rx_total) AS net_rx_total, MAX(net_tx_total) AS net_tx_total,
-            CAST(MAX(processes) AS INTEGER) AS processes,
-            CAST(MAX(tcp_connections) AS INTEGER) AS tcp_connections,
-            CAST(MAX(udp_connections) AS INTEGER) AS udp_connections,
-            SUM(gpu_usage * sample_count) / SUM(sample_count) AS gpu_usage,
-            MAX(disk_read_bps) AS disk_read_bps,
-            MAX(disk_write_bps) AS disk_write_bps,
-            MAX(disk_read_iops) AS disk_read_iops,
-            MAX(disk_write_iops) AS disk_write_iops,
-            MAX(disk_await_ms) AS disk_await_ms,
-            MAX(disk_utilization) AS disk_utilization,
-            SUM(sample_count) AS sample_count,
-            MAX(CASE WHEN latest_position = 1 THEN latest_timestamp END) AS latest_timestamp
-          FROM ranked GROUP BY server_id, bucket
-        ), latency_ranked AS (
-          SELECT h.server_id, (h.timestamp / 3600) * 3600 AS bucket,
-            json_extract(j.value, '$.task_id') AS task_id,
-            CAST(json_extract(j.value, '$.latency_ms') AS REAL) AS latency_ms,
-            CAST(json_extract(j.value, '$.packet_loss') AS REAL) AS packet_loss,
-            CAST(json_extract(j.value, '$.sample_count') AS INTEGER) AS sample_count,
-            CAST(json_extract(j.value, '$.success_count') AS INTEGER) AS success_count,
-            CAST(json_extract(j.value, '$.latest_timestamp') AS INTEGER) AS latest_timestamp,
-            CAST(json_extract(j.value, '$.latest_latency_ms') AS REAL) AS latest_latency_ms,
-            CAST(json_extract(j.value, '$.latest_packet_loss') AS REAL) AS latest_packet_loss,
-            ROW_NUMBER() OVER (
-              PARTITION BY h.server_id, h.timestamp / 3600, json_extract(j.value, '$.task_id')
-              ORDER BY CAST(json_extract(j.value, '$.latest_timestamp') AS INTEGER) DESC
-            ) AS latest_position
-          FROM recent h, json_each(h.latency_json) j
-          WHERE h.timestamp >= ?1 AND h.timestamp < ?2
-        ), latency_tasks AS (
-          SELECT server_id, bucket, task_id,
-            CASE WHEN SUM(success_count) > 0
-              THEN SUM(latency_ms * success_count) / SUM(success_count)
-              ELSE -1 END AS latency_ms,
-            SUM(packet_loss * sample_count) / SUM(sample_count) AS packet_loss,
-            SUM(sample_count) AS sample_count,
-            SUM(success_count) AS success_count,
-            MAX(CASE WHEN latest_position = 1 THEN latest_timestamp END) AS latest_timestamp,
-            MAX(CASE WHEN latest_position = 1 THEN latest_latency_ms END) AS latest_latency_ms,
-            MAX(CASE WHEN latest_position = 1 THEN latest_packet_loss END) AS latest_packet_loss
-          FROM latency_ranked GROUP BY server_id, bucket, task_id
-        ), latency_packed AS (
-          SELECT server_id, bucket, json_group_array(json_object(
-            'task_id', task_id, 'timestamp', bucket,
-            'latency_ms', latency_ms, 'packet_loss', packet_loss,
-            'sample_count', sample_count, 'success_count', success_count,
-            'latest_timestamp', latest_timestamp,
-            'latest_latency_ms', latest_latency_ms,
-            'latest_packet_loss', latest_packet_loss
-          )) AS latency_json
-          FROM latency_tasks GROUP BY server_id, bucket
-        ) INSERT INTO metric_history_hourly (
-          server_id, timestamp, cpu, load1, load5, load15, mem_used, mem_total,
-          swap_used, swap_total, disk_used, disk_total, net_in, net_out,
-          net_rx_total, net_tx_total, processes, tcp_connections, udp_connections,
-          gpu_usage, disk_read_bps, disk_write_bps, disk_read_iops, disk_write_iops,
-          disk_await_ms, disk_utilization, sample_count,
-          latest_timestamp, latency_json
-        ) SELECT
-          m.server_id, m.bucket, m.cpu, m.load1, m.load5, m.load15, m.mem_used,
-          m.mem_total, m.swap_used, m.swap_total, m.disk_used, m.disk_total,
-          m.net_in, m.net_out, m.net_rx_total, m.net_tx_total, m.processes,
-          m.tcp_connections, m.udp_connections, m.gpu_usage, m.disk_read_bps,
-          m.disk_write_bps, m.disk_read_iops, m.disk_write_iops, m.disk_await_ms,
-          m.disk_utilization, m.sample_count, m.latest_timestamp,
-          COALESCE(l.latency_json, '[]')
-        FROM metrics m LEFT JOIN latency_packed l
-          ON l.server_id = m.server_id AND l.bucket = m.bucket
-        WHERE true
-        -- 直接覆盖，不做累加。上面的 CTE 是从两代分钟表里把这个小时桶的全部
-        -- 源行重新算了一遍，所以 excluded 就是该桶的完整真值。
-        -- 一个桶的源行在分钟表里可见 24-48 小时，而它在写完后的第一次 cron 就会
-        -- 被压缩，所以每次压缩看到的都是完整的桶；等源行被轮换丢弃时，这个桶也
-        -- 不再出现在 union 里，不会再触发 upsert。
-        -- 覆盖语义顺带让压缩对乱序到达免疫：迟到的行只是让下一次重算包含它。
-        ON CONFLICT(server_id, timestamp) DO UPDATE SET
-          cpu=excluded.cpu, load1=excluded.load1, load5=excluded.load5,
-          load15=excluded.load15, mem_used=excluded.mem_used,
-          mem_total=excluded.mem_total, swap_used=excluded.swap_used,
-          swap_total=excluded.swap_total, disk_used=excluded.disk_used,
-          disk_total=excluded.disk_total, net_in=excluded.net_in,
-          net_out=excluded.net_out, net_rx_total=excluded.net_rx_total,
-          net_tx_total=excluded.net_tx_total, processes=excluded.processes,
-          tcp_connections=excluded.tcp_connections,
-          udp_connections=excluded.udp_connections,
-          gpu_usage=excluded.gpu_usage, disk_read_bps=excluded.disk_read_bps,
-          disk_write_bps=excluded.disk_write_bps,
-          disk_read_iops=excluded.disk_read_iops,
-          disk_write_iops=excluded.disk_write_iops,
-          disk_await_ms=excluded.disk_await_ms,
-          disk_utilization=excluded.disk_utilization,
-          sample_count=excluded.sample_count,
-          latest_timestamp=excluded.latest_timestamp,
-          latency_json=excluded.latency_json"#,
-        )
-        .bind(&[number(cutoff), number(complete_hours_before)])?;
-    let delete_archive = db
-        .prepare("DELETE FROM metric_history_hourly WHERE timestamp < ?1")
-        .bind(&[number(cutoff)])?;
-    // 压缩和保留期删除先原子提交；轮换随后在另一个原子 batch 中完成。
-    // 两个阶段都可独立重试，且轮换失败时不会留下缺少当前表的半完成状态。
-    db.batch(vec![compact, delete_archive]).await?;
-    rotate_recent_history(db).await
-}
-
-/// 丢弃上一代分钟历史，把当前代降级为上一代，再建一张空的当前代。
-async fn rotate_recent_history(db: &D1Database) -> Result<()> {
-    // D1 batch guarantees transactional execution, including SQLite DDL. If any
-    // statement fails, the prior pair of recent-history tables remains intact.
-    db.batch(vec![
-        db.prepare("DROP TABLE IF EXISTS metric_history_old"),
-        db.prepare("ALTER TABLE metric_history RENAME TO metric_history_old"),
-        db.prepare(metric_history_ddl("metric_history")),
-    ])
-    .await?;
-    Ok(())
-}
-
-/// 保留期下界，对齐到整小时。
-fn history_cutoff(current: i64, retention_days: i64) -> i64 {
-    let cutoff = current - retention_days.clamp(1, MAX_HISTORY_RETENTION_DAYS) * 86_400;
-    cutoff.div_euclid(3600) * 3600
-}
-
-pub async fn clear_history(db: &D1Database) -> Result<()> {
-    db.batch(vec![
-        db.prepare("DELETE FROM metric_history"),
-        db.prepare("DELETE FROM metric_history_old"),
-        db.prepare("DELETE FROM metric_history_hourly"),
-    ])
-    .await?;
-    Ok(())
-}
-
-pub async fn exchange_rate_snapshot(
-    db: &D1Database,
-    base_currency: &str,
-) -> Result<Option<ExchangeRateSnapshot>> {
-    db.prepare(
-        "SELECT base_currency, rates_json, source, rate_date, fetched_at, attempted_at \
-         FROM exchange_rate_snapshots WHERE base_currency = ?1",
-    )
-    .bind(&[text(base_currency)])?
-    .first(None)
-    .await
-}
-
-pub async fn mark_exchange_rate_attempt(
-    db: &D1Database,
-    base_currency: &str,
-    attempted_at: i64,
-) -> Result<()> {
-    db.prepare(
-        "INSERT INTO exchange_rate_snapshots( \
-           base_currency, rates_json, source, rate_date, fetched_at, attempted_at \
-         ) VALUES (?1, '{}', 'default', '', 0, ?2) \
-         ON CONFLICT(base_currency) DO UPDATE SET attempted_at=excluded.attempted_at",
-    )
-    .bind(&[text(base_currency), number(attempted_at)])?
-    .run()
-    .await?;
-    Ok(())
-}
-
-pub async fn upsert_exchange_rate_snapshot(
-    db: &D1Database,
-    base_currency: &str,
-    rates_json: &str,
-    source: &str,
-    rate_date: &str,
-    fetched_at: i64,
-) -> Result<()> {
-    db.prepare(
-        "INSERT INTO exchange_rate_snapshots( \
-           base_currency, rates_json, source, rate_date, fetched_at, attempted_at \
-         ) VALUES (?1, ?2, ?3, ?4, ?5, ?5) \
-         ON CONFLICT(base_currency) DO UPDATE SET \
-           rates_json=excluded.rates_json, source=excluded.source, \
-           rate_date=excluded.rate_date, fetched_at=excluded.fetched_at, \
-           attempted_at=excluded.attempted_at",
-    )
-    .bind(&[
-        text(base_currency),
-        text(rates_json),
-        text(source),
-        text(rate_date),
-        number(fetched_at),
-    ])?
-    .run()
-    .await?;
-    Ok(())
-}
-
-pub async fn database_stats(db: &D1Database, offline_threshold: i64) -> Result<DatabaseStats> {
-    let cutoff = now() - offline_threshold.clamp(30, 3600);
-    db.prepare(
-        r#"SELECT
-          (SELECT COUNT(*) FROM servers) AS server_count,
-          -- 在线判定读 server_latest_state：它和 metric_history 在同一个 batch 里
-          -- 写同一个 latest_timestamp，且只随 servers 的外键级联删除——轮换 DROP
-          -- 掉分钟表不影响它，所以它是各来源里的最大值，主键又正好是 server_id。
-          -- 原来那版按服务器逐行 MAX(latest_timestamp) over (分钟表 UNION 上一代)，
-          -- 每台一次全表扫；这版是主键点查。
-          (SELECT COUNT(*) FROM servers s WHERE COALESCE(
-             (SELECT l.latest_timestamp FROM server_latest_state l
-              WHERE l.server_id = s.id),
-             0
-           ) >= ?1) AS online_count,
-          ((SELECT COUNT(*) FROM metric_history) +
-           (SELECT COUNT(*) FROM metric_history_old) +
-           (SELECT COUNT(*) FROM metric_history_hourly)) AS history_rows"#,
-    )
-    .bind(&[number(cutoff)])?
-    .first(None)
-    .await?
-    .ok_or_else(|| worker::Error::RustError("无法读取数据库统计".to_string()))
-}
-
-pub async fn get_setting(db: &D1Database, key: &str) -> Result<Option<String>> {
-    db.prepare("SELECT json_extract(value, ?1) AS value FROM settings WHERE id = 1")
-        .bind(&[text(&format!("$.{key}"))])?
-        .first::<String>(Some("value"))
-        .await
-}
-
-pub async fn save_setting(db: &D1Database, key: &str, value: &str) -> Result<()> {
-    db.prepare("UPDATE settings SET value=json_set(value, ?1, ?2), updated_at=?3 WHERE id=1")
-        .bind(&[text(&format!("$.{key}")), text(value), number(now())])?
-        .run()
-        .await?;
-    Ok(())
-}
-
-pub async fn increment_setting(db: &D1Database, key: &str) -> Result<()> {
-    db.prepare(
-        "UPDATE settings SET value=json_set( \
-           value, ?1, CAST(CAST(COALESCE(json_extract(value, ?1), '0') AS INTEGER) + 1 AS TEXT) \
-         ), updated_at=?2 WHERE id=1",
-    )
-    .bind(&[text(&format!("$.{key}")), number(now())])?
-    .run()
-    .await?;
-    Ok(())
-}
-
-pub async fn update_expiry(db: &D1Database, id: &str, expires_at: i64) -> Result<()> {
-    db.prepare("UPDATE servers SET expires_at = ?2, updated_at = ?3 WHERE id = ?1")
-        .bind(&[text(id), number(expires_at), number(now())])?
-        .run()
-        .await?;
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::{
-        alert_window_covered, history_cutoff, metric_history_ddl, secret_for_api,
-        traffic_cycle_key, AlertMetricRow, HistoryMetricAggregate, MAX_HISTORY_RETENTION_DAYS,
-        SECRET_MASK,
-    };
-    use crate::models::AgentReport;
-
-    fn row(samples: i64, last_timestamp: i64, report_interval: i64) -> AlertMetricRow {
-        AlertMetricRow {
-            server_id: "server".to_string(),
-            name: "Server".to_string(),
-            value: 90.0,
-            sample_count: samples,
-            first_timestamp: last_timestamp - samples.saturating_sub(1) * 60,
-            last_timestamp,
-            report_interval,
-        }
-    }
-
-    #[test]
-    fn alert_coverage_tracks_report_interval_and_freshness() {
-        let current = 10_000;
-        // 落库间隔 60s 时分钟样本每分钟一行，10 分钟窗口期望 10 个样本，
-        // 覆盖线是 (10*3+4)/5 = 6 个；report_interval 300 高于下限，不受影响。
-        assert!(alert_window_covered(&row(6, current - 30, 60), 10, current));
-        assert!(!alert_window_covered(
-            &row(5, current - 30, 60),
-            10,
-            current
-        ));
-        assert!(alert_window_covered(
-            &row(2, current - 60, 300),
-            10,
-            current
-        ));
-        assert!(!alert_window_covered(
-            &row(2, current - 700, 300),
-            10,
-            current
-        ));
-    }
-
-    #[test]
-    fn aligns_history_cutoff_and_caps_retention() {
-        let current = 40 * 86_400 + 12 * 3600 + 34 * 60 + 56;
-        let cutoff = history_cutoff(current, 365);
-        assert_eq!(cutoff % 3600, 0);
-        assert_eq!(
-            cutoff,
-            (40 - MAX_HISTORY_RETENTION_DAYS) * 86_400 + 12 * 3600
-        );
-    }
-
-    /// 轮换要在运行时重建 `metric_history`，DDL 因此在 Rust 里存了一份。
-    /// 这个测试比对它和 migration 的文本，防止两边漂移。三张 metric_* 表必须同构：
-    /// 轮换靠 RENAME 把当前代变成上一代，压缩靠 UNION ALL 同时读它们。
-    #[test]
-    fn metric_history_ddl_matches_migration() {
-        let schema = include_str!("../migrations/initial_01.sql");
-
-        let table_body = |sql: &str, table: &str| -> String {
-            let head = format!("CREATE TABLE {table} (");
-            let start = sql.find(&head).unwrap_or_else(|| {
-                panic!("migration 里找不到 {table}");
-            }) + head.len();
-            let rest = &sql[start..];
-            let end = rest.find(") WITHOUT ROWID").expect("缺少 WITHOUT ROWID");
-            rest[..end].split_whitespace().collect::<Vec<_>>().join(" ")
-        };
-
-        let generated = table_body(&metric_history_ddl("metric_history"), "metric_history");
-        for table in [
-            "metric_history",
-            "metric_history_old",
-            "metric_history_hourly",
-        ] {
-            assert_eq!(
-                generated,
-                table_body(schema, table),
-                "migration 的 {table} 与 db::metric_history_ddl 不一致"
-            );
-        }
-    }
-
-    #[test]
-    fn masks_stored_secrets_in_api_responses() {
-        assert_eq!(secret_for_api(""), "");
-        assert_eq!(secret_for_api("stored-secret"), SECRET_MASK);
-    }
-
-    #[test]
-    fn assigns_monthly_traffic_periods_with_short_months() {
-        let timestamp = |year: i64, month: i64, day: i64| {
-            let year = year - i64::from(month <= 2);
-            let era = year.div_euclid(400);
-            let year_of_era = year - era * 400;
-            let month_prime = month + if month > 2 { -3 } else { 9 };
-            let day_of_year = (153 * month_prime + 2) / 5 + day - 1;
-            let day_of_era = year_of_era * 365 + year_of_era / 4 - year_of_era / 100 + day_of_year;
-            (era * 146_097 + day_of_era - 719_468) * 86_400
-        };
-        assert_eq!(traffic_cycle_key(timestamp(2026, 8, 9), 10), 2026 * 12 + 6);
-        assert_eq!(traffic_cycle_key(timestamp(2026, 8, 10), 10), 2026 * 12 + 7);
-        assert_eq!(traffic_cycle_key(timestamp(2028, 2, 28), 31), 2028 * 12);
-        assert_eq!(traffic_cycle_key(timestamp(2028, 2, 29), 31), 2028 * 12 + 1);
-    }
-
-    #[test]
-    fn aggregates_history_with_averages_and_peaks() {
-        let reports = [
-            AgentReport {
-                timestamp: 121,
-                cpu: 10.0,
-                mem_used: 100,
-                swap_used: 20,
-                net_in: 50.0,
-                net_out: 80.0,
-                processes: 4,
-                tcp_connections: 7,
-                udp_connections: 2,
-                disk_read_bps: 30.0,
-                disk_write_bps: 90.0,
-                disk_read_iops: 3.0,
-                disk_write_iops: 9.0,
-                disk_await_ms: 2.0,
-                disk_utilization: 20.0,
-                ..AgentReport::default()
-            },
-            AgentReport {
-                timestamp: 124,
-                cpu: 30.0,
-                mem_used: 300,
-                mem_total: 1_000,
-                swap_used: 60,
-                swap_total: 500,
-                net_in: 200.0,
-                net_out: 40.0,
-                net_rx_total: 2_000,
-                net_tx_total: 3_000,
-                processes: 2,
-                tcp_connections: 5,
-                udp_connections: 8,
-                disk_read_bps: 100.0,
-                disk_write_bps: 20.0,
-                disk_read_iops: 10.0,
-                disk_write_iops: 2.0,
-                disk_await_ms: 5.0,
-                disk_utilization: 10.0,
-                ..AgentReport::default()
-            },
-        ];
-        let mut aggregate = HistoryMetricAggregate::default();
-        aggregate.extend(&reports[..1]);
-        aggregate.extend(&reports[1..]);
-        let point = aggregate.point().unwrap();
-
-        assert_eq!(aggregate.sample_count(), 2);
-        assert_eq!(point.timestamp, 120);
-        assert_eq!(point.cpu, 20.0);
-        assert_eq!(point.mem_used, 200);
-        assert_eq!(point.swap_used, 40);
-        assert_eq!(point.net_in, 200.0);
-        assert_eq!(point.net_out, 80.0);
-        assert_eq!(point.processes, 4);
-        assert_eq!(point.tcp_connections, 7);
-        assert_eq!(point.udp_connections, 8);
-        assert_eq!(point.disk_read_bps, 100.0);
-        assert_eq!(point.disk_write_bps, 90.0);
-        assert_eq!(point.disk_read_iops, 10.0);
-        assert_eq!(point.disk_write_iops, 9.0);
-        assert_eq!(point.disk_await_ms, 5.0);
-        assert_eq!(point.disk_utilization, 20.0);
-        assert_eq!(point.net_rx_total, 2_000);
-        assert_eq!(point.net_tx_total, 3_000);
-    }
-}
diff --git a/src/exchange.rs b/src/exchange.rs
deleted file mode 100644
index 6c9a509..0000000
--- a/src/exchange.rs
+++ /dev/null
@@ -1,312 +0,0 @@
-use std::{collections::BTreeMap, time::Duration};
-
-use serde::Serialize;
-use serde_json::Value;
-use worker::{D1Database, Error, Headers, Method, Request, RequestInit, Result};
-
-use crate::outbound::{fetch_with_timeout, read_json_limited};
-
-use crate::{cloudflare, db};
-
-const BASE_CURRENCY: &str = "CNY";
-const PRIMARY_URL: &str = "https://open.er-api.com/v6/latest/CNY";
-const FALLBACK_URL: &str = "https://api.frankfurter.dev/v1/latest?base=CNY";
-const REFRESH_INTERVAL: i64 = 86_400;
-const RETRY_INTERVAL: i64 = 3_600;
-const UPSTREAM_JSON_MAX_BYTES: usize = 256 * 1024;
-
-#[derive(Debug)]
-struct FetchedRates {
-    rates: BTreeMap<String, f64>,
-    source: &'static str,
-    date: String,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct ExchangeRatesView {
-    pub base: String,
-    pub rates: BTreeMap<String, f64>,
-    pub source: String,
-    pub date: String,
-    pub fetched_at: i64,
-    pub stale: bool,
-}
-
-fn default_rates() -> BTreeMap<String, f64> {
-    [
-        ("CNY", 1.0),
-        ("USD", 0.14799),
-        ("CAD", 0.2086),
-        ("HKD", 1.1594),
-        ("EUR", 0.1275),
-        ("GBP", 0.11027),
-        ("JPY", 23.707),
-        ("RUB", 11.560694),
-        ("CHF", 0.120661),
-        ("INR", 14.248668),
-        ("VND", 3875.968992),
-        ("THB", 4.97107),
-    ]
-    .into_iter()
-    .map(|(currency, rate)| (currency.to_string(), rate))
-    .collect()
-}
-
-fn valid_currency(value: &str) -> bool {
-    value.len() == 3
-        && value
-            .chars()
-            .all(|character| character.is_ascii_alphabetic())
-}
-
-fn valid_date(value: &str) -> bool {
-    let bytes = value.as_bytes();
-    bytes.len() == 10
-        && bytes[4] == b'-'
-        && bytes[7] == b'-'
-        && bytes
-            .iter()
-            .enumerate()
-            .all(|(index, value)| index == 4 || index == 7 || value.is_ascii_digit())
-}
-
-fn sanitize_rates(value: &Value) -> Option<BTreeMap<String, f64>> {
-    let object = value.as_object()?;
-    let mut rates = BTreeMap::new();
-    for (currency, value) in object {
-        let currency = currency.trim().to_ascii_uppercase();
-        let Some(rate) = value.as_f64() else {
-            continue;
-        };
-        if valid_currency(&currency) && rate.is_finite() && (1e-12..=1e12).contains(&rate) {
-            rates.insert(currency, rate);
-        }
-    }
-    rates.insert(BASE_CURRENCY.to_string(), 1.0);
-    Some(rates)
-}
-
-fn required_rates_present(rates: &BTreeMap<String, f64>) -> bool {
-    ["CNY", "USD", "CAD", "HKD", "EUR", "GBP", "JPY"]
-        .iter()
-        .all(|currency| rates.get(*currency).is_some_and(|rate| *rate > 0.0))
-}
-
-fn parse_frankfurter(value: &Value) -> Option<FetchedRates> {
-    if value
-        .get("base")
-        .and_then(Value::as_str)
-        .is_none_or(|base| !base.eq_ignore_ascii_case(BASE_CURRENCY))
-    {
-        return None;
-    }
-    let date = value.get("date")?.as_str()?.to_string();
-    if !valid_date(&date) {
-        return None;
-    }
-    let rates = sanitize_rates(value.get("rates")?)?;
-    required_rates_present(&rates).then_some(FetchedRates {
-        rates,
-        source: "frankfurter",
-        date,
-    })
-}
-
-fn parse_er_api(value: &Value) -> Option<FetchedRates> {
-    if value.get("result").and_then(Value::as_str) != Some("success")
-        || value
-            .get("base_code")
-            .and_then(Value::as_str)
-            .is_none_or(|base| !base.eq_ignore_ascii_case(BASE_CURRENCY))
-    {
-        return None;
-    }
-    let timestamp = value.get("time_last_update_unix")?.as_i64()?;
-    if timestamp <= 0 {
-        return None;
-    }
-    let rates = sanitize_rates(value.get("rates")?)?;
-    required_rates_present(&rates).then_some(FetchedRates {
-        rates,
-        source: "er-api",
-        date: cloudflare::date_from_unix_days(timestamp.div_euclid(86_400)),
-    })
-}
-
-async fn fetch_json(url: &str) -> Result<Value> {
-    let headers = Headers::new();
-    headers.set("Accept", "application/json")?;
-    headers.set("User-Agent", "NodeFlare-Exchange-Rates")?;
-    let mut init = RequestInit::new();
-    init.with_method(Method::Get).with_headers(headers);
-    let request = Request::new_with_init(url, &init)?;
-    let Some(mut response) = fetch_with_timeout(request, Duration::from_secs(8)).await? else {
-        return Err(Error::RustError(
-            "exchange-rate upstream request timed out".to_string(),
-        ));
-    };
-    let status = response.status_code();
-    if !(200..300).contains(&status) {
-        return Err(Error::RustError(format!(
-            "exchange-rate upstream returned HTTP {status}"
-        )));
-    }
-    read_json_limited(&mut response, UPSTREAM_JSON_MAX_BYTES).await
-}
-
-async fn fetch_latest() -> Result<FetchedRates> {
-    match fetch_json(PRIMARY_URL).await {
-        Ok(value) => {
-            if let Some(rates) = parse_er_api(&value) {
-                return Ok(rates);
-            }
-        }
-        Err(error) => worker::console_warn!("er-api exchange-rate request failed: {error}"),
-    }
-    match fetch_json(FALLBACK_URL).await {
-        Ok(value) => parse_frankfurter(&value).ok_or_else(|| {
-            Error::RustError("exchange-rate fallback returned invalid data".to_string())
-        }),
-        Err(error) => Err(Error::RustError(format!(
-            "all exchange-rate sources failed: {error}"
-        ))),
-    }
-}
-
-fn due(fetched_at: i64, attempted_at: i64, current: i64, force: bool) -> bool {
-    force
-        || ((fetched_at <= 0 || current.saturating_sub(fetched_at) >= REFRESH_INTERVAL)
-            && (attempted_at <= 0 || current.saturating_sub(attempted_at) >= RETRY_INTERVAL))
-}
-
-fn view_from_snapshot(
-    snapshot: Option<db::ExchangeRateSnapshot>,
-    current: i64,
-) -> ExchangeRatesView {
-    let snapshot = snapshot.unwrap_or_else(|| db::ExchangeRateSnapshot {
-        base_currency: BASE_CURRENCY.to_string(),
-        rates_json: serde_json::to_string(&default_rates()).unwrap_or_else(|_| "{}".to_string()),
-        source: "default".to_string(),
-        rate_date: String::new(),
-        fetched_at: 0,
-        attempted_at: 0,
-    });
-    let mut rates = serde_json::from_str::<Value>(&snapshot.rates_json)
-        .ok()
-        .and_then(|value| sanitize_rates(&value))
-        .unwrap_or_else(default_rates);
-    for (currency, rate) in default_rates() {
-        rates.entry(currency).or_insert(rate);
-    }
-    let stale =
-        snapshot.fetched_at <= 0 || current.saturating_sub(snapshot.fetched_at) >= REFRESH_INTERVAL;
-    ExchangeRatesView {
-        base: snapshot.base_currency,
-        rates,
-        source: snapshot.source,
-        date: snapshot.rate_date,
-        fetched_at: snapshot.fetched_at,
-        stale,
-    }
-}
-
-pub async fn current(database: &D1Database, current: i64) -> Result<ExchangeRatesView> {
-    let snapshot = db::exchange_rate_snapshot(database, BASE_CURRENCY).await?;
-    Ok(view_from_snapshot(snapshot, current))
-}
-
-pub async fn refresh(
-    database: &D1Database,
-    current: i64,
-    force: bool,
-) -> Result<(ExchangeRatesView, bool)> {
-    let snapshot = db::exchange_rate_snapshot(database, BASE_CURRENCY).await?;
-    if !snapshot
-        .as_ref()
-        .is_none_or(|value| due(value.fetched_at, value.attempted_at, current, force))
-    {
-        return Ok((view_from_snapshot(snapshot, current), false));
-    }
-
-    db::mark_exchange_rate_attempt(database, BASE_CURRENCY, current).await?;
-    let fetched = fetch_latest().await?;
-    let mut rates = default_rates();
-    rates.extend(fetched.rates);
-    let rates_json = serde_json::to_string(&rates)?;
-    db::upsert_exchange_rate_snapshot(
-        database,
-        BASE_CURRENCY,
-        &rates_json,
-        fetched.source,
-        &fetched.date,
-        current,
-    )
-    .await?;
-    let snapshot = db::exchange_rate_snapshot(database, BASE_CURRENCY).await?;
-    Ok((view_from_snapshot(snapshot, current), true))
-}
-
-#[cfg(test)]
-mod tests {
-    use super::{default_rates, parse_er_api, parse_frankfurter};
-
-    #[test]
-    fn provides_all_frontend_asset_currencies() {
-        let rates = default_rates();
-        for currency in [
-            "CNY", "USD", "HKD", "EUR", "GBP", "JPY", "RUB", "CHF", "INR", "VND", "THB", "CAD",
-        ] {
-            assert!(rates.get(currency).is_some_and(|rate| *rate > 0.0));
-        }
-    }
-
-    #[test]
-    fn parses_frankfurter_cny_rates() {
-        let value = serde_json::json!({
-            "base": "CNY",
-            "date": "2026-08-08",
-            "rates": {
-                "USD": 0.14,
-                "CAD": 0.20,
-                "HKD": 1.09,
-                "EUR": 0.12,
-                "GBP": 0.10,
-                "JPY": 21.0
-            }
-        });
-        let parsed = parse_frankfurter(&value).expect("valid rates");
-        assert_eq!(parsed.source, "frankfurter");
-        assert_eq!(parsed.rates.get("CNY"), Some(&1.0));
-        assert_eq!(parsed.rates.get("CAD"), Some(&0.20));
-    }
-
-    #[test]
-    fn parses_er_api_fallback() {
-        let value = serde_json::json!({
-            "result": "success",
-            "base_code": "CNY",
-            "time_last_update_unix": 1786118400,
-            "rates": {
-                "USD": 0.14,
-                "CAD": 0.20,
-                "HKD": 1.09,
-                "EUR": 0.12,
-                "GBP": 0.10,
-                "JPY": 21.0
-            }
-        });
-        let parsed = parse_er_api(&value).expect("valid fallback rates");
-        assert_eq!(parsed.source, "er-api");
-        assert_eq!(parsed.date, "2026-08-07");
-    }
-
-    #[test]
-    fn rejects_incomplete_or_wrong_base_rates() {
-        let wrong_base = serde_json::json!({
-            "base": "USD",
-            "date": "2026-08-08",
-            "rates": {"CNY": 7.0}
-        });
-        assert!(parse_frankfurter(&wrong_base).is_none());
-    }
-}
diff --git a/src/latency.rs b/src/latency.rs
deleted file mode 100644
index 3558bba..0000000
--- a/src/latency.rs
+++ /dev/null
@@ -1,536 +0,0 @@
-use std::collections::{BTreeMap, HashMap};
-
-use serde::{Deserialize, Serialize};
-use worker::{wasm_bindgen::JsValue, D1Database, Date, Result};
-
-use crate::models::{AgentLatencyResult, AgentLatencyTask, LatencyTaskInput};
-
-pub const MAX_LATENCY_TASKS: usize = 128;
-const MAX_HISTORY_RESPONSE_ROWS: i64 = 4000;
-
-#[derive(Debug, Deserialize)]
-struct TaskRow {
-    id: String,
-    name: String,
-    task_type: String,
-    target: String,
-    port: Option<i64>,
-    interval_seconds: i64,
-    default_enabled: i64,
-}
-
-#[derive(Debug, Deserialize)]
-struct AssignmentRow {
-    task_id: String,
-    server_id: String,
-}
-
-#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
-pub(crate) struct StoredLatencyResult {
-    task_id: String,
-    timestamp: i64,
-    latency_ms: f64,
-    packet_loss: f64,
-    sample_count: u64,
-    success_count: u64,
-    latest_timestamp: i64,
-    latest_latency_ms: f64,
-    latest_packet_loss: f64,
-}
-
-#[derive(Debug, Clone, Default, Deserialize, Serialize)]
-// Tuple layout keeps Durable Object WebSocket attachments below Cloudflare's
-// 16 KiB serialized-attachment limit even with all 128 latency tasks enabled.
-struct LatencyMetricAggregate(u64, u64, f64, f64, i64, f64, f64);
-
-#[derive(Debug, Clone, Default, Deserialize, Serialize)]
-pub struct LatencyMetricAggregates {
-    #[serde(rename = "v")]
-    values: BTreeMap<String, LatencyMetricAggregate>,
-}
-
-impl LatencyMetricAggregates {
-    pub fn extend(&mut self, results: &[AgentLatencyResult], received_at: i64) {
-        for result in results {
-            if !self.values.contains_key(&result.task_id) && self.values.len() >= MAX_LATENCY_TASKS
-            {
-                continue;
-            }
-            let timestamp = if (result.timestamp - received_at).abs() <= 86_400 {
-                result.timestamp
-            } else {
-                received_at
-            };
-            let aggregate = self.values.entry(result.task_id.clone()).or_default();
-            aggregate.0 = aggregate.0.saturating_add(1);
-            aggregate.3 += result.packet_loss;
-            if result.latency_ms >= 0.0 {
-                aggregate.1 = aggregate.1.saturating_add(1);
-                aggregate.2 += result.latency_ms;
-            }
-            if timestamp >= aggregate.4 {
-                aggregate.4 = timestamp;
-                aggregate.5 = result.latency_ms;
-                aggregate.6 = result.packet_loss;
-            }
-        }
-    }
-
-    pub fn merge(&mut self, other: Self) {
-        for (task_id, other) in other.values {
-            if !self.values.contains_key(&task_id) && self.values.len() >= MAX_LATENCY_TASKS {
-                continue;
-            }
-            let aggregate = self.values.entry(task_id).or_default();
-            aggregate.0 = aggregate.0.saturating_add(other.0);
-            aggregate.1 = aggregate.1.saturating_add(other.1);
-            aggregate.2 += other.2;
-            aggregate.3 += other.3;
-            if other.4 > aggregate.4 {
-                aggregate.4 = other.4;
-                aggregate.5 = other.5;
-                aggregate.6 = other.6;
-            }
-        }
-    }
-
-    fn rows_matching(&self, mut include: impl FnMut(&String) -> bool) -> Vec<StoredLatencyResult> {
-        let mut history = Vec::new();
-        for (task_id, aggregate) in self.values.iter().filter(|(task_id, _)| include(task_id)) {
-            history.push(StoredLatencyResult {
-                task_id: task_id.clone(),
-                timestamp: aggregate.4 / 60 * 60,
-                latency_ms: if aggregate.1 == 0 {
-                    -1.0
-                } else {
-                    aggregate.2 / aggregate.1 as f64
-                },
-                packet_loss: aggregate.3 / aggregate.0.max(1) as f64,
-                sample_count: aggregate.0,
-                success_count: aggregate.1,
-                latest_timestamp: aggregate.4,
-                latest_latency_ms: aggregate.5,
-                latest_packet_loss: aggregate.6,
-            });
-        }
-        history
-    }
-
-    pub fn stored_json(&self) -> Result<String> {
-        Ok(serde_json::to_string(&self.rows_matching(|_| true))?)
-    }
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct LatencyTaskView {
-    pub id: String,
-    pub name: String,
-    pub task_type: String,
-    pub target: String,
-    pub port: Option<i64>,
-    pub interval_seconds: i64,
-    pub default_enabled: bool,
-    pub server_ids: Vec<String>,
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize)]
-pub struct LatencySample {
-    pub task_id: String,
-    pub server_id: String,
-    pub name: String,
-    pub task_type: String,
-    pub target: String,
-    pub port: Option<i64>,
-    pub timestamp: i64,
-    pub latency_ms: f64,
-    pub packet_loss: f64,
-}
-
-fn text(value: &str) -> JsValue {
-    JsValue::from_str(value)
-}
-
-fn number(value: impl ToString) -> JsValue {
-    JsValue::from_f64(value.to_string().parse::<f64>().unwrap_or(0.0))
-}
-
-pub async fn list_tasks(db: &D1Database) -> Result<Vec<LatencyTaskView>> {
-    let rows: Vec<TaskRow> = db
-        .prepare(
-            "SELECT id, name, task_type, target, port, interval_seconds, default_enabled \
-             FROM latency_tasks \
-             ORDER BY sort_order ASC, created_at ASC",
-        )
-        .all()
-        .await?
-        .results()?;
-    let assignments: Vec<AssignmentRow> = db
-        .prepare(
-            "SELECT task_id, server_id FROM latency_task_servers \
-             ORDER BY task_id ASC, server_id ASC",
-        )
-        .all()
-        .await?
-        .results()?;
-    let mut by_task: HashMap<String, Vec<String>> = HashMap::new();
-    for assignment in assignments {
-        by_task
-            .entry(assignment.task_id)
-            .or_default()
-            .push(assignment.server_id);
-    }
-    Ok(rows
-        .into_iter()
-        .map(|row| LatencyTaskView {
-            server_ids: by_task.remove(&row.id).unwrap_or_default(),
-            id: row.id,
-            name: row.name,
-            task_type: row.task_type,
-            target: row.target,
-            port: row.port,
-            interval_seconds: row.interval_seconds,
-            default_enabled: row.default_enabled != 0,
-        })
-        .collect())
-}
-
-pub async fn task_count(db: &D1Database) -> Result<i64> {
-    db.prepare("SELECT COUNT(*) AS count FROM latency_tasks")
-        .first(Some("count"))
-        .await?
-        .ok_or_else(|| worker::Error::RustError("无法读取延迟任务数量".to_string()))
-}
-
-pub async fn server_ids_for_task(db: &D1Database, task_id: &str) -> Result<Vec<String>> {
-    let assignments: Vec<AssignmentRow> = db
-        .prepare(
-            "SELECT task_id, server_id FROM latency_task_servers WHERE task_id = ?1 ORDER BY server_id ASC",
-        )
-        .bind(&[text(task_id)])?
-        .all()
-        .await?
-        .results()?;
-    Ok(assignments
-        .into_iter()
-        .map(|assignment| assignment.server_id)
-        .collect())
-}
-
-pub async fn tasks_for_server(db: &D1Database, server_id: &str) -> Result<Vec<AgentLatencyTask>> {
-    db.prepare(
-        "SELECT t.id, t.name, t.task_type, t.target, t.port, t.interval_seconds \
-         FROM latency_tasks t \
-         INNER JOIN latency_task_servers a ON a.task_id = t.id \
-         WHERE a.server_id = ?1 ORDER BY t.sort_order ASC, t.created_at ASC",
-    )
-    .bind(&[text(server_id)])?
-    .all()
-    .await?
-    .results()
-}
-
-pub async fn create_task(
-    db: &D1Database,
-    id: &str,
-    input: &LatencyTaskInput,
-    timestamp: i64,
-) -> Result<()> {
-    let server_ids = serde_json::to_string(&input.server_ids)?;
-    let statements = vec![
-        db.prepare(
-            "INSERT INTO latency_tasks( \
-               id, name, task_type, target, port, interval_seconds, default_enabled, \
-               sort_order, created_at, updated_at \
-             ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, \
-               COALESCE((SELECT MAX(sort_order) + 1 FROM latency_tasks), 0), ?8, ?8)",
-        )
-        .bind(&[
-            text(id),
-            text(input.name.trim()),
-            text(input.task_type.trim()),
-            text(input.target.trim()),
-            input.port.map(number).unwrap_or(JsValue::NULL),
-            number(input.interval_seconds),
-            JsValue::from_bool(input.default_enabled),
-            number(timestamp),
-        ])?,
-        db.prepare(
-            "INSERT INTO latency_task_servers(task_id, server_id, assigned_at) \
-             SELECT ?1, CAST(value AS TEXT), ?3 FROM json_each(?2)",
-        )
-        .bind(&[text(id), text(&server_ids), number(timestamp)])?,
-    ];
-    db.batch(statements).await?;
-    Ok(())
-}
-
-pub async fn update_task(
-    db: &D1Database,
-    id: &str,
-    input: &LatencyTaskInput,
-    timestamp: i64,
-) -> Result<bool> {
-    let exists: Option<TaskRow> = db
-        .prepare(
-            "SELECT id, name, task_type, target, port, interval_seconds, default_enabled \
-             FROM latency_tasks WHERE id = ?1",
-        )
-        .bind(&[text(id)])?
-        .first(None)
-        .await?;
-    let Some(existing) = exists else {
-        return Ok(false);
-    };
-    let reset_history = existing.task_type != input.task_type.trim()
-        || existing.target != input.target.trim()
-        || existing.port != input.port;
-    let server_ids = serde_json::to_string(&input.server_ids)?;
-    let mut statements = vec![
-        db.prepare(
-            "UPDATE latency_tasks SET name = ?2, task_type = ?3, target = ?4, port = ?5, \
-             interval_seconds = ?6, default_enabled = ?7, updated_at = ?8 WHERE id = ?1",
-        )
-        .bind(&[
-            text(id),
-            text(input.name.trim()),
-            text(input.task_type.trim()),
-            text(input.target.trim()),
-            input.port.map(number).unwrap_or(JsValue::NULL),
-            number(input.interval_seconds),
-            JsValue::from_bool(input.default_enabled),
-            number(timestamp),
-        ])?,
-        db.prepare(
-            "DELETE FROM latency_task_servers WHERE task_id = ?1 AND server_id NOT IN ( \
-               SELECT CAST(value AS TEXT) FROM json_each(?2) \
-             )",
-        )
-        .bind(&[text(id), text(&server_ids)])?,
-        db.prepare(
-            "INSERT OR IGNORE INTO latency_task_servers(task_id, server_id, assigned_at) \
-             SELECT ?1, CAST(value AS TEXT), ?3 FROM json_each(?2)",
-        )
-        .bind(&[text(id), text(&server_ids), number(timestamp)])?,
-    ];
-    if reset_history {
-        statements.push(
-            db.prepare("UPDATE latency_task_servers SET assigned_at = ?2 WHERE task_id = ?1")
-                .bind(&[text(id), number(timestamp)])?,
-        );
-    }
-    db.batch(statements).await?;
-    Ok(true)
-}
-
-pub async fn delete_task(db: &D1Database, id: &str) -> Result<bool> {
-    let result = db
-        .prepare("DELETE FROM latency_tasks WHERE id = ?1")
-        .bind(&[text(id)])?
-        .run()
-        .await?;
-    Ok(result.meta()?.and_then(|meta| meta.changes).unwrap_or(0) > 0)
-}
-
-pub async fn assign_defaults(db: &D1Database, server_id: &str) -> Result<()> {
-    db.prepare(
-        "INSERT OR IGNORE INTO latency_task_servers(task_id, server_id, assigned_at) \
-         SELECT id, ?1, ?2 FROM latency_tasks WHERE default_enabled = 1",
-    )
-    .bind(&[text(server_id), number(crate::now())])?
-    .run()
-    .await?;
-    Ok(())
-}
-
-#[cfg(test)]
-fn compact_results(
-    results: &[AgentLatencyResult],
-    assigned: &std::collections::HashSet<String>,
-    received_at: i64,
-) -> Vec<StoredLatencyResult> {
-    let mut aggregates = LatencyMetricAggregates::default();
-    aggregates.extend(results, received_at);
-    aggregates.rows_matching(|task_id| assigned.contains(task_id))
-}
-
-pub async fn latest_all(db: &D1Database) -> Result<Vec<LatencySample>> {
-    db.prepare(latest_query(None)).all().await?.results()
-}
-
-fn latest_query(filter: Option<&str>) -> String {
-    let filter = filter.map_or(String::new(), |value| format!("WHERE {value}"));
-    format!(
-        "WITH assignments AS ( \
-           SELECT a.task_id, a.server_id, a.assigned_at, t.name, t.task_type, \
-             t.target, t.port, t.sort_order, t.created_at \
-           FROM latency_task_servers a \
-           INNER JOIN latency_tasks t ON t.id = a.task_id {filter} \
-         ), latest AS ( \
-           SELECT assignments.*, COALESCE( \
-             (SELECT j.value FROM (SELECT * FROM metric_history \
-                                   UNION ALL SELECT * FROM metric_history_old) h, \
-                                  json_each(h.latency_json) j \
-              WHERE h.server_id = assignments.server_id \
-                AND json_extract(j.value, '$.task_id') = assignments.task_id \
-                AND CAST(json_extract(j.value, '$.latest_timestamp') AS INTEGER) >= assignments.assigned_at \
-              ORDER BY h.timestamp DESC LIMIT 1), \
-             (SELECT j.value FROM metric_history_hourly h, json_each(h.latency_json) j \
-              WHERE h.server_id = assignments.server_id \
-                AND json_extract(j.value, '$.task_id') = assignments.task_id \
-                AND CAST(json_extract(j.value, '$.latest_timestamp') AS INTEGER) >= assignments.assigned_at \
-              ORDER BY h.timestamp DESC LIMIT 1) \
-           ) AS result FROM assignments \
-         ) SELECT task_id, server_id, name, task_type, target, port, \
-           COALESCE(CAST(json_extract(result, '$.latest_timestamp') AS INTEGER), 0) AS timestamp, \
-           COALESCE(CAST(json_extract(result, '$.latest_latency_ms') AS REAL), -1) AS latency_ms, \
-           COALESCE(CAST(json_extract(result, '$.latest_packet_loss') AS REAL), -1) AS packet_loss \
-         FROM latest ORDER BY sort_order ASC, created_at ASC"
-    )
-}
-
-/// 把一张历史表的 `latency_json` 摊平成延迟样本行。
-fn latency_samples_from(table: &str) -> String {
-    format!(
-        "SELECT h.server_id, h.timestamp, json_extract(j.value, '$.task_id') AS task_id, \
-           CAST(json_extract(j.value, '$.latency_ms') AS REAL) AS latency_ms, \
-           CAST(json_extract(j.value, '$.packet_loss') AS REAL) AS packet_loss, \
-           CAST(json_extract(j.value, '$.sample_count') AS INTEGER) AS sample_count, \
-           CAST(json_extract(j.value, '$.success_count') AS INTEGER) AS success_count, \
-           CAST(json_extract(j.value, '$.latest_timestamp') AS INTEGER) AS latest_timestamp \
-         FROM {table} h, json_each(h.latency_json) j"
-    )
-}
-
-pub async fn history(db: &D1Database, server_id: &str, hours: i64) -> Result<Vec<LatencySample>> {
-    let hours = hours.clamp(1, 24 * crate::db::MAX_HISTORY_RETENTION_DAYS);
-    let cutoff = (Date::now().as_millis() as i64 / 1000) - hours * 3600;
-    let task_count = db
-        .prepare("SELECT COUNT(*) AS count FROM latency_task_servers WHERE server_id = ?1")
-        .bind(&[text(server_id)])?
-        .first::<i64>(Some("count"))
-        .await?
-        .unwrap_or(0);
-    if task_count == 0 {
-        return Ok(Vec::new());
-    }
-    let bucket = history_bucket_seconds(hours, task_count);
-    // 分钟历史分两代（见 db::RECENT_HISTORY），近期区间必须都读。
-    let mut tables = vec!["metric_history", "metric_history_old"];
-    if hours > 24 {
-        tables.push("metric_history_hourly");
-    }
-    let source = tables
-        .into_iter()
-        .map(latency_samples_from)
-        .collect::<Vec<_>>()
-        .join(" UNION ALL ");
-    let query = format!(
-        "SELECT h.task_id, h.server_id, t.name, t.task_type, t.target, t.port, \
-         (h.timestamp / {bucket}) * {bucket} AS timestamp, \
-         CASE WHEN SUM(h.success_count) > 0 \
-           THEN SUM(h.latency_ms * h.success_count) / SUM(h.success_count) \
-           ELSE -1 END AS latency_ms, \
-         SUM(h.packet_loss * h.sample_count) / SUM(h.sample_count) AS packet_loss \
-         FROM ({source}) h INNER JOIN latency_tasks t ON t.id = h.task_id \
-         INNER JOIN latency_task_servers a \
-           ON a.task_id = h.task_id AND a.server_id = h.server_id \
-         WHERE h.server_id = ?1 AND h.timestamp >= ?2 AND h.latest_timestamp >= a.assigned_at \
-         GROUP BY h.task_id, h.server_id, t.name, t.task_type, t.target, t.port, h.timestamp / {bucket} \
-         ORDER BY timestamp ASC, t.sort_order ASC LIMIT {MAX_HISTORY_RESPONSE_ROWS}"
-    );
-    db.prepare(query)
-        .bind(&[text(server_id), number(cutoff)])?
-        .all()
-        .await?
-        .results()
-}
-
-fn history_bucket_seconds(hours: i64, task_count: i64) -> i64 {
-    let hours = hours.clamp(1, 24 * crate::db::MAX_HISTORY_RETENTION_DAYS);
-    let task_count = task_count.clamp(1, MAX_LATENCY_TASKS as i64);
-    let base = match hours {
-        1 => 60,
-        2..=4 => 120,
-        5..=24 => 600,
-        25..=168 => 3600,
-        169..=720 => 14_400,
-        _ => 86_400,
-    };
-    let points_per_task = (MAX_HISTORY_RESPONSE_ROWS / task_count).max(1);
-    let bounded = (hours * 3600 + points_per_task - 1) / points_per_task;
-    base.max(bounded)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::{compact_results, history_bucket_seconds, MAX_LATENCY_TASKS};
-    use crate::models::AgentLatencyResult;
-    use std::collections::HashSet;
-
-    #[test]
-    fn compacts_latency_results_by_task_and_minute() {
-        let assigned = HashSet::from(["task-a".to_string()]);
-        let results = vec![
-            AgentLatencyResult {
-                task_id: "task-a".to_string(),
-                timestamp: 121,
-                latency_ms: 10.0,
-                packet_loss: 0.0,
-            },
-            AgentLatencyResult {
-                task_id: "task-a".to_string(),
-                timestamp: 149,
-                latency_ms: 20.0,
-                packet_loss: 25.0,
-            },
-            AgentLatencyResult {
-                task_id: "unassigned".to_string(),
-                timestamp: 149,
-                latency_ms: 1.0,
-                packet_loss: 0.0,
-            },
-        ];
-        let history = compact_results(&results, &assigned, 150);
-        assert_eq!(history.len(), 1);
-        assert_eq!(history[0].timestamp, 120);
-        assert_eq!(history[0].latency_ms, 15.0);
-        assert_eq!(history[0].packet_loss, 12.5);
-        assert_eq!(history[0].sample_count, 2);
-        assert_eq!(history[0].success_count, 2);
-        assert_eq!(history[0].latest_timestamp, 149);
-        assert_eq!(history[0].latest_latency_ms, 20.0);
-        assert_eq!(history[0].latest_packet_loss, 25.0);
-    }
-
-    #[test]
-    fn bounds_compacted_latency_history_by_task() {
-        let assigned = (0..128)
-            .map(|index| format!("task-{index}"))
-            .collect::<HashSet<_>>();
-        let results = (0..40)
-            .flat_map(|minute| {
-                (0..128).map(move |task| AgentLatencyResult {
-                    task_id: format!("task-{task}"),
-                    timestamp: 1_000_000 + minute * 60,
-                    latency_ms: task as f64,
-                    packet_loss: 0.0,
-                })
-            })
-            .collect::<Vec<_>>();
-        let history = compact_results(&results, &assigned, results.last().unwrap().timestamp);
-        assert_eq!(history.len(), MAX_LATENCY_TASKS);
-        assert_eq!(
-            history.last().unwrap().timestamp,
-            results.last().unwrap().timestamp / 60 * 60
-        );
-    }
-
-    #[test]
-    fn bounds_latency_history_response_across_tasks() {
-        assert_eq!(history_bucket_seconds(1, 1), 60);
-        assert_eq!(history_bucket_seconds(24, 1), 600);
-        assert!(history_bucket_seconds(1, 128) >= 117);
-        assert!(24 * 3600 / history_bucket_seconds(24, 128) * 128 <= 4000);
-        assert_eq!(history_bucket_seconds(720, 1), 14_400);
-    }
-}
diff --git a/src/lib.rs b/src/lib.rs
deleted file mode 100644
index 745fabe..0000000
--- a/src/lib.rs
+++ /dev/null
@@ -1,1578 +0,0 @@
-mod auth;
-mod cloudflare;
-mod db;
-mod exchange;
-mod latency;
-mod live;
-mod models;
-mod notify;
-mod outbound;
-mod routes;
-mod theme;
-mod turnstile;
-
-use std::collections::HashSet;
-use std::net::{Ipv4Addr, Ipv6Addr};
-use std::time::Duration;
-
-use futures_util::TryStreamExt;
-use serde::{de::DeserializeOwned, Serialize};
-use worker::*;
-
-use crate::auth::{
-    bearer_token, is_admin, random_salt, sha256_hex, verify_turnstile_proof, ADMIN_SESSION_SECONDS,
-};
-use crate::models::{
-    AgentDiskMetric, AgentGpuMetric, AgentReport, AlertRuleInput, ApiError, LatencyTaskInput,
-    ServerInput, ServerView, ThemeInput,
-};
-
-pub(crate) const ADMIN_HTML: &[u8] = include_bytes!(concat!(env!("OUT_DIR"), "/admin.html"));
-pub(crate) const ADMIN_SCRIPT: &[u8] = include_bytes!(concat!(env!("OUT_DIR"), "/admin.js"));
-pub(crate) const ADMIN_STYLE: &[u8] = include_bytes!(concat!(env!("OUT_DIR"), "/admin.css"));
-pub(crate) const API_JSON_MAX_BYTES: usize = 1024 * 1024;
-pub(crate) const MAX_AGENT_SAMPLES: usize = 720;
-const SERVER_RENEWAL_INTERVAL_SECONDS: i64 = 60 * 60;
-const REMOTE_THEME_FETCH_TIMEOUT: Duration = Duration::from_secs(10);
-pub(crate) const VERSION: &str = match option_env!("NODEFLARE_VERSION") {
-    Some(version) => version,
-    None => env!("CARGO_PKG_VERSION"),
-};
-
-#[derive(Serialize)]
-struct PublicServer {
-    id: String,
-    name: String,
-    region: String,
-    group_name: String,
-    tags: String,
-    expires_at: Option<i64>,
-    traffic_limit: i64,
-    traffic_limit_type: String,
-    price: f64,
-    billing_cycle: i64,
-    currency: String,
-    auto_renewal: bool,
-    reset_day: i64,
-    timestamp: Option<i64>,
-    cpu: Option<f64>,
-    load1: Option<f64>,
-    load5: Option<f64>,
-    load15: Option<f64>,
-    mem_used: Option<i64>,
-    mem_total: Option<i64>,
-    swap_used: Option<i64>,
-    swap_total: Option<i64>,
-    disk_used: Option<i64>,
-    disk_total: Option<i64>,
-    net_in: Option<f64>,
-    net_out: Option<f64>,
-    net_rx_total: Option<i64>,
-    net_tx_total: Option<i64>,
-    uptime: Option<i64>,
-    processes: Option<i64>,
-    tcp_connections: Option<i64>,
-    udp_connections: Option<i64>,
-    cpu_cores: Option<i64>,
-    cpu_model: Option<String>,
-    os: Option<String>,
-    kernel: Option<String>,
-    arch: Option<String>,
-    virtualization: Option<String>,
-    gpu_usage: Option<f64>,
-    gpu_model: Option<String>,
-    agent_version: Option<String>,
-    disk_read_bps: Option<f64>,
-    disk_write_bps: Option<f64>,
-    disk_read_iops: Option<f64>,
-    disk_write_iops: Option<f64>,
-    disk_await_ms: Option<f64>,
-    disk_utilization: Option<f64>,
-    disks: Vec<AgentDiskMetric>,
-    gpus: Vec<AgentGpuMetric>,
-    latency: Vec<latency::LatencySample>,
-}
-
-pub(crate) fn now() -> i64 {
-    Date::now().as_millis() as i64 / 1000
-}
-
-fn env_text(env: &Env, key: &str, fallback: &str) -> String {
-    env.var(key)
-        .ok()
-        .map(|v| v.to_string())
-        .filter(|value| !value.trim().is_empty())
-        .unwrap_or_else(|| fallback.to_string())
-}
-
-fn env_number(env: &Env, key: &str, fallback: i64) -> i64 {
-    env_text(env, key, &fallback.to_string())
-        .parse()
-        .unwrap_or(fallback)
-}
-
-fn env_secret_text(env: &Env, key: &str) -> String {
-    env.secret(key)
-        .or_else(|_| env.var(key))
-        .map(|value| value.to_string())
-        .unwrap_or_default()
-}
-
-pub(crate) fn settings_for_admin_response(
-    mut settings: db::SettingsView,
-    env: &Env,
-) -> db::SettingsView {
-    for (field, variable) in [
-        (&mut settings.turnstile_site_key, "TURNSTILE_SITE_KEY"),
-        (&mut settings.turnstile_secret_key, "TURNSTILE_SECRET_KEY"),
-        (&mut settings.cloudflare_account_id, "CF_USAGE_ACCOUNT_ID"),
-        (&mut settings.cloudflare_api_token, "CF_USAGE_API_TOKEN"),
-    ] {
-        if field.trim().is_empty() && !env_secret_text(env, variable).trim().is_empty() {
-            *field = db::SECRET_MASK.to_string();
-        }
-    }
-    settings
-}
-
-fn json<T: Serialize>(value: &T, status: u16) -> Result<Response> {
-    let mut response = Response::from_json(value)?.with_status(status);
-    set_api_headers(&mut response)?;
-    Ok(response)
-}
-
-fn set_api_headers(response: &mut Response) -> Result<()> {
-    let headers = response.headers_mut();
-    headers.set("Cache-Control", "no-store")?;
-    headers.set("X-Content-Type-Options", "nosniff")?;
-    headers.set("Referrer-Policy", "no-referrer")?;
-    headers.set(
-        "Permissions-Policy",
-        "camera=(), microphone=(), geolocation=()",
-    )?;
-    Ok(())
-}
-
-pub(crate) fn no_content() -> Result<Response> {
-    let mut response = Response::empty()?.with_status(204);
-    set_api_headers(&mut response)?;
-    Ok(response)
-}
-
-pub(crate) fn set_admin_session_cookie(
-    response: &mut Response,
-    req: &Request,
-    token: Option<&str>,
-) -> Result<()> {
-    let secure = req.url().ok().is_some_and(|url| url.scheme() == "https");
-    let (value, max_age) = token
-        .map(|value| (value, ADMIN_SESSION_SECONDS))
-        .unwrap_or(("", 0));
-    response.headers_mut().append(
-        "Set-Cookie",
-        &format!(
-            "nodeflare_admin={value}; Path=/; Max-Age={max_age}; HttpOnly{}; SameSite=Strict",
-            if secure { "; Secure" } else { "" }
-        ),
-    )?;
-    Ok(())
-}
-
-async fn request_json<T: DeserializeOwned>(req: &mut Request, limit: usize) -> Result<T> {
-    if req
-        .headers()
-        .get("Content-Length")?
-        .and_then(|value| value.parse::<usize>().ok())
-        .is_some_and(|length| length == 0 || length > limit)
-    {
-        return Err(Error::RustError(
-            "JSON request body size is invalid".to_string(),
-        ));
-    }
-    let mut bytes = Vec::new();
-    let mut stream = req.stream()?;
-    while let Some(mut chunk) = stream.try_next().await? {
-        if bytes
-            .len()
-            .checked_add(chunk.len())
-            .is_none_or(|length| length > limit)
-        {
-            return Err(Error::RustError(
-                "JSON request body is too large".to_string(),
-            ));
-        }
-        bytes.append(&mut chunk);
-    }
-    serde_json::from_slice(&bytes).map_err(|error| Error::RustError(error.to_string()))
-}
-
-pub(crate) fn error(message: &str, status: u16) -> Result<Response> {
-    json(
-        &ApiError {
-            error: message,
-            request_id: None,
-        },
-        status,
-    )
-}
-
-fn internal_error(request_id: &str) -> Result<Response> {
-    let mut response = json(
-        &ApiError {
-            error: "服务暂时不可用，请稍后重试",
-            request_id: Some(request_id),
-        },
-        500,
-    )?;
-    response.headers_mut().set("X-Request-Id", request_id)?;
-    Ok(response)
-}
-
-fn request_id(req: &Request) -> String {
-    req.headers()
-        .get("CF-Ray")
-        .ok()
-        .flatten()
-        .filter(|value| !value.trim().is_empty())
-        .or_else(random_salt)
-        .unwrap_or_else(|| format!("local-{}", Date::now().as_millis() as i64))
-}
-
-fn rate_limited() -> Result<Response> {
-    let mut response = error("请求过于频繁，请稍后重试", 429)?;
-    response.headers_mut().set("Retry-After", "60")?;
-    Ok(response)
-}
-
-fn mutable_response(response: Response) -> Result<Response> {
-    let status = response.status_code();
-    let headers = Headers::new();
-    for (name, value) in response.headers().entries() {
-        headers.append(&name, &value)?;
-    }
-    let (_, body) = response.into_parts();
-    Ok(Response::from_body(body)?
-        .with_status(status)
-        .with_headers(headers))
-}
-
-pub(crate) fn embedded_admin_response(body: &[u8], content_type: &str) -> Result<Response> {
-    let mut response = Response::from_bytes(body.to_vec())?;
-    let headers = response.headers_mut();
-    headers.set("Content-Type", content_type)?;
-    headers.set("Cache-Control", "no-store")?;
-    headers.set("X-Content-Type-Options", "nosniff")?;
-    headers.set("X-Frame-Options", "DENY")?;
-    headers.set("Referrer-Policy", "strict-origin-when-cross-origin")?;
-    headers.set(
-        "Permissions-Policy",
-        "camera=(), microphone=(), geolocation=()",
-    )?;
-    headers.set(
-        "Content-Security-Policy",
-        "default-src 'self'; script-src 'self' https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self'; frame-src https://challenges.cloudflare.com; font-src 'self' data:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'",
-    )?;
-    Ok(response)
-}
-
-pub(crate) fn secure_public_response(mut response: Response) -> Result<Response> {
-    let headers = response.headers_mut();
-    headers.set("X-Content-Type-Options", "nosniff")?;
-    headers.set("X-Frame-Options", "DENY")?;
-    headers.set("Referrer-Policy", "strict-origin-when-cross-origin")?;
-    headers.set(
-        "Permissions-Policy",
-        "camera=(), microphone=(), geolocation=()",
-    )?;
-    headers.set(
-        "Content-Security-Policy",
-        "default-src 'self'; script-src 'self' https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' ws: wss:; frame-src https://challenges.cloudflare.com; font-src 'self' data:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'",
-    )?;
-    Ok(response)
-}
-
-fn remote_theme_content_type(path: &str) -> Option<&'static str> {
-    let path = path.split('?').next().unwrap_or(path);
-    if path == "index.html" {
-        return Some("text/html; charset=utf-8");
-    }
-    match path.rsplit_once('.').map(|(_, extension)| extension) {
-        Some("js" | "mjs") => Some("application/javascript; charset=utf-8"),
-        Some("css") => Some("text/css; charset=utf-8"),
-        Some("json" | "map") => Some("application/json; charset=utf-8"),
-        Some("svg") => Some("image/svg+xml"),
-        Some("png") => Some("image/png"),
-        Some("jpg" | "jpeg") => Some("image/jpeg"),
-        Some("webp") => Some("image/webp"),
-        Some("ico") => Some("image/x-icon"),
-        Some("woff") => Some("font/woff"),
-        Some("woff2") => Some("font/woff2"),
-        Some("ttf") => Some("font/ttf"),
-        Some("wasm") => Some("application/wasm"),
-        _ => None,
-    }
-}
-
-fn remote_theme_failure(message: &str) -> Result<Response> {
-    let mut response = Response::error(message, 502)?;
-    response.headers_mut().set("Cache-Control", "no-store")?;
-    secure_public_response(response)
-}
-
-fn rewrite_remote_theme_index(html: &str, asset_prefix: &str) -> String {
-    html.replace("\"/assets/", &format!("\"{asset_prefix}"))
-        .replace("'/assets/", &format!("'{asset_prefix}"))
-}
-
-async fn remote_theme_response(path: &str, base: &str) -> Result<Option<Response>> {
-    let (remote_url, relative) =
-        if path == "/" || path == "/index.html" || path.starts_with("/instance/") {
-            let Some(index) = theme::index_url(base) else {
-                return Ok(Some(remote_theme_failure("远程主题来源不受支持")?));
-            };
-            (index, "index.html".to_string())
-        } else if let Some(url) = theme::asset_url(base, path) {
-            (url, path.trim_start_matches('/').to_string())
-        } else {
-            return Ok(Some(remote_theme_failure("远程主题资源路径不受支持")?));
-        };
-    let is_index = relative == "index.html";
-    let cache = Cache::default();
-    let cache_key = format!("{remote_url}?nodeflare-theme-cache=2");
-    if let Ok(Some(response)) = cache.get(&cache_key, false).await {
-        return Ok(Some(secure_public_response(mutable_response(response)?)?));
-    }
-    let request = Request::new(&remote_url, Method::Get)?;
-    let mut response = match outbound::fetch_with_timeout(request, REMOTE_THEME_FETCH_TIMEOUT).await
-    {
-        Ok(Some(response)) if (200..300).contains(&response.status_code()) => response,
-        Ok(Some(response)) => {
-            console_warn!(
-                "remote theme returned HTTP {} for {}",
-                response.status_code(),
-                remote_url
-            );
-            return if is_index {
-                Ok(None)
-            } else {
-                Ok(Some(remote_theme_failure("远程主题资源暂时不可用")?))
-            };
-        }
-        Ok(None) => {
-            console_warn!("remote theme request timed out for {remote_url}");
-            return if is_index {
-                Ok(None)
-            } else {
-                Ok(Some(remote_theme_failure("远程主题资源请求超时")?))
-            };
-        }
-        Err(error) => {
-            console_warn!("remote theme request failed for {remote_url}: {error}");
-            return if is_index {
-                Ok(None)
-            } else {
-                Ok(Some(remote_theme_failure("远程主题资源加载失败")?))
-            };
-        }
-    };
-    let limit = if is_index {
-        theme::INDEX_MAX_BYTES
-    } else {
-        theme::ASSET_MAX_BYTES
-    };
-    let Some(body) = outbound::read_response_limited(&mut response, limit).await? else {
-        return if is_index {
-            Ok(None)
-        } else {
-            Ok(Some(remote_theme_failure("远程主题资源大小无效")?))
-        };
-    };
-    let body = if is_index {
-        let html = String::from_utf8(body)
-            .map_err(|_| Error::RustError("主题 index.html 不是 UTF-8 文本".to_string()))?;
-        rewrite_remote_theme_index(&html, "/__theme-active/assets/").into_bytes()
-    } else {
-        body
-    };
-    let mut response = Response::from_bytes(body)?;
-    let headers = response.headers_mut();
-    headers.set("Cache-Control", "public, max-age=300")?;
-    if let Some(content_type) = remote_theme_content_type(&relative) {
-        headers.set("Content-Type", content_type)?;
-    }
-    let mut response = secure_public_response(response)?;
-    if let Ok(cached) = response.cloned() {
-        let _ = cache.put(&cache_key, cached).await;
-    }
-    Ok(Some(response))
-}
-
-async fn remote_theme_preview_response(
-    relative: &str,
-    base: &str,
-    preview_prefix: &str,
-) -> Result<Response> {
-    if relative.starts_with("assets/") {
-        let path = format!("/{relative}");
-        return Ok(remote_theme_response(&path, base)
-            .await?
-            .unwrap_or(remote_theme_failure("主题预览资源不存在")?));
-    }
-    if !relative.is_empty() && relative != "index.html" && !relative.starts_with("instance/") {
-        return Response::error("主题预览资源不存在", 404);
-    }
-    let Some(index) = theme::index_url(base) else {
-        return remote_theme_failure("远程主题来源不受支持");
-    };
-    let request = Request::new(&index, Method::Get)?;
-    let Some(mut response) =
-        outbound::fetch_with_timeout(request, REMOTE_THEME_FETCH_TIMEOUT).await?
-    else {
-        return remote_theme_failure("主题预览页面请求超时");
-    };
-    if !(200..300).contains(&response.status_code()) {
-        return remote_theme_failure("主题预览页面暂时不可用");
-    }
-    let Some(body) = outbound::read_response_limited(&mut response, theme::INDEX_MAX_BYTES).await?
-    else {
-        return remote_theme_failure("主题预览页面大小无效");
-    };
-    let html = String::from_utf8(body)
-        .map_err(|_| Error::RustError("主题 index.html 不是 UTF-8 文本".to_string()))?;
-    let asset_prefix = format!("{preview_prefix}/assets/");
-    let html = rewrite_remote_theme_index(&html, &asset_prefix);
-    let mut response = Response::from_html(html)?;
-    response.headers_mut().set("Cache-Control", "no-store")?;
-    secure_public_response(response)
-}
-
-fn valid_ping_target(value: &str) -> bool {
-    let raw = value.trim();
-    if raw.is_empty() {
-        return false;
-    }
-    if raw.len() > 60
-        || raw.contains("://")
-        || raw
-            .chars()
-            .any(|character| character.is_whitespace() || ":/@?#\\[]".contains(character))
-    {
-        return false;
-    }
-
-    if raw.len() > 50 || raw.starts_with('.') || raw.ends_with('.') {
-        return false;
-    }
-
-    let labels = raw.split('.').collect::<Vec<_>>();
-    let ipv4_like = labels.len() == 4
-        && labels
-            .iter()
-            .all(|label| !label.is_empty() && label.chars().all(|c| c.is_ascii_digit()));
-    if ipv4_like {
-        return raw.parse::<Ipv4Addr>().is_ok_and(public_probe_ipv4);
-    }
-    let lower = raw.to_ascii_lowercase();
-    if labels.len() < 2
-        || ["local", "localhost", "internal", "lan", "localdomain"]
-            .iter()
-            .any(|suffix| lower == *suffix || lower.ends_with(&format!(".{suffix}")))
-        || lower == "home.arpa"
-        || lower.ends_with(".home.arpa")
-    {
-        return false;
-    }
-    labels.iter().all(|label| {
-        !label.is_empty()
-            && label.len() <= 63
-            && label
-                .chars()
-                .all(|character| character.is_ascii_alphanumeric() || character == '-')
-            && label
-                .chars()
-                .next()
-                .is_some_and(|character| character.is_ascii_alphanumeric())
-            && label
-                .chars()
-                .last()
-                .is_some_and(|character| character.is_ascii_alphanumeric())
-    })
-}
-
-fn public_probe_ipv4(address: Ipv4Addr) -> bool {
-    let [a, b, c, _] = address.octets();
-    !(a == 0
-        || a == 10
-        || a == 127
-        || (a == 100 && (64..=127).contains(&b))
-        || (a == 169 && b == 254)
-        || (a == 172 && (16..=31).contains(&b))
-        || (a == 192 && b == 0 && c == 0)
-        || (a == 192 && b == 0 && c == 2)
-        || (a == 192 && b == 168)
-        || (a == 198 && (b == 18 || b == 19))
-        || (a == 198 && b == 51 && c == 100)
-        || (a == 203 && b == 0 && c == 113)
-        || a >= 224)
-}
-
-pub(crate) fn valid_cloudflare_account_id(value: &str) -> bool {
-    let value = value.trim();
-    value == db::SECRET_MASK
-        || value.is_empty()
-        || (value.len() == 32 && value.chars().all(|character| character.is_ascii_hexdigit()))
-}
-
-pub(crate) fn valid_cloudflare_api_token(value: &str) -> bool {
-    let value = value.trim();
-    value.chars().count() <= 512 && !value.chars().any(char::is_whitespace)
-}
-
-pub(crate) fn valid_password_derived(value: &str) -> bool {
-    value.len() == 64
-        && value
-            .bytes()
-            .all(|byte| byte.is_ascii_digit() || matches!(byte, b'a'..=b'f'))
-}
-
-pub(crate) fn valid_public_asset_url(value: &str) -> bool {
-    let value = value.trim();
-    if value.is_empty() {
-        return true;
-    }
-    if value.chars().count() > 1000 {
-        return false;
-    }
-    Url::parse(value).is_ok_and(|url| {
-        url.scheme() == "https"
-            && url.host_str().is_some_and(|host| !host.is_empty())
-            && url.username().is_empty()
-            && url.password().is_none()
-    })
-}
-
-pub(crate) fn valid_background_urls(value: &str) -> bool {
-    let value = value.trim();
-    if value.is_empty() {
-        return true;
-    }
-    if value.chars().count() > 1000 {
-        return false;
-    }
-    let parts = value.split('|').collect::<Vec<_>>();
-    parts.len() <= 2
-        && parts.iter().any(|part| !part.trim().is_empty())
-        && parts
-            .iter()
-            .all(|part| part.trim().is_empty() || valid_public_asset_url(part))
-}
-
-fn valid_server_price(value: f64) -> bool {
-    value.is_finite() && (-1.0..=1_000_000_000.0).contains(&value)
-}
-
-fn submitted_secret<'a>(submitted: Option<&'a str>, stored: &'a str) -> &'a str {
-    match submitted.map(str::trim) {
-        Some(db::SECRET_MASK) | None => stored.trim(),
-        Some(value) => value,
-    }
-}
-
-fn same_origin(origin: &str, request_url: &Url) -> bool {
-    origin.trim().trim_end_matches('/') == request_url.origin().ascii_serialization()
-}
-
-pub(crate) fn validate_latency_task(input: &LatencyTaskInput) -> Option<&'static str> {
-    let name_len = input.name.trim().chars().count();
-    if !(1..=80).contains(&name_len) {
-        return Some("任务名称长度应为 1 至 80 个字符");
-    }
-    if !matches!(input.task_type.as_str(), "tcp" | "icmp") {
-        return Some("延迟类型仅支持 TCP 或 ICMP");
-    }
-    let target = input.target.trim();
-    if target.is_empty() || !valid_ping_target(target) {
-        return Some("目标应为公网域名或公网 IPv4");
-    }
-    if input.task_type == "tcp" {
-        if input.port.is_none_or(|port| !(1..=65535).contains(&port)) {
-            return Some("TCP 端口应为 1 至 65535");
-        }
-    } else if input.port.is_some() {
-        return Some("ICMP 检测不使用端口");
-    }
-    if !(30..=3600).contains(&input.interval_seconds) {
-        return Some("延迟检测间隔应为 30 至 3600 秒");
-    }
-    if input.server_ids.len() > 500
-        || input
-            .server_ids
-            .iter()
-            .any(|id| id.is_empty() || id.len() > 80)
-        || input.server_ids.iter().collect::<HashSet<_>>().len() != input.server_ids.len()
-    {
-        return Some("服务器选择列表无效");
-    }
-    None
-}
-
-pub(crate) fn validate_alert_rule(input: &AlertRuleInput) -> Option<&'static str> {
-    if !(1..=80).contains(&input.name.trim().chars().count()) {
-        return Some("规则名称长度应为 1 至 80 个字符");
-    }
-    if !matches!(
-        input.metric.as_str(),
-        "cpu" | "memory" | "disk" | "net_in" | "net_out"
-    ) {
-        return Some("告警指标无效");
-    }
-    let maximum = if matches!(input.metric.as_str(), "cpu" | "memory" | "disk") {
-        100.0
-    } else {
-        1_000_000.0
-    };
-    if !input.threshold.is_finite() || input.threshold <= 0.0 || input.threshold > maximum {
-        return Some("告警阈值超出允许范围");
-    }
-    if !(1..=1440).contains(&input.duration_minutes) {
-        return Some("告警时间窗口应为 1 至 1440 分钟");
-    }
-    if !matches!(input.aggregation.as_str(), "average" | "continuous") {
-        return Some("告警判断方式无效");
-    }
-    if input.server_ids.len() > 500
-        || input
-            .server_ids
-            .iter()
-            .any(|id| id.is_empty() || id.len() > 80)
-        || input.server_ids.iter().collect::<HashSet<_>>().len() != input.server_ids.len()
-    {
-        return Some("告警服务器列表无效");
-    }
-    None
-}
-
-pub(crate) fn validate_theme(input: &ThemeInput) -> Option<&'static str> {
-    if !(1..=80).contains(&input.name.trim().chars().count()) {
-        return Some("主题名称长度应为 1 至 80 个字符");
-    }
-    if input.description.trim().chars().count() > 300 {
-        return Some("主题说明不能超过 300 个字符");
-    }
-    if theme::normalize_url(&input.url).is_none() {
-        return Some("主题 URL 仅支持 GitHub 地址");
-    }
-    None
-}
-
-pub(crate) fn validate_server(input: &ServerInput) -> Option<&'static str> {
-    let name_len = input.name.trim().chars().count();
-    if !(1..=80).contains(&name_len) {
-        return Some("节点名称长度应为 1 至 80 个字符");
-    }
-    if input.region.chars().count() > 16 || input.group_name.chars().count() > 40 {
-        return Some("地区或分组字段过长");
-    }
-    if input.tags.chars().count() > 240 {
-        return Some("标签字段过长");
-    }
-    if input.traffic_limit < 0 {
-        return Some("流量限额不能为负数");
-    }
-    if !matches!(
-        input.traffic_limit_type.as_str(),
-        "sum" | "max" | "min" | "up" | "down"
-    ) {
-        return Some("流量计算方式无效");
-    }
-    if !valid_server_price(input.price) {
-        return Some("价格无效");
-    }
-    if !(0..=3650).contains(&input.billing_cycle) {
-        return Some("计费周期应为 0（一次性）或 1 至 3650 天");
-    }
-    if input.currency.len() != 3
-        || !input
-            .currency
-            .chars()
-            .all(|value| value.is_ascii_alphabetic())
-    {
-        return Some("币种应为 3 位字母代码");
-    }
-    if !(1..=31).contains(&input.reset_day) {
-        return Some("流量重置日应为 1 至 31");
-    }
-    if !(15..=3600).contains(&input.report_interval) {
-        return Some("上报间隔应为 15 至 3600 秒");
-    }
-    if !(1..=60).contains(&input.collect_interval) || input.collect_interval > input.report_interval
-    {
-        return Some("采样间隔应为 1 至 60 秒且不能大于上报间隔");
-    }
-    if (input.report_interval + input.collect_interval - 1) / input.collect_interval
-        > MAX_AGENT_SAMPLES as i64
-    {
-        return Some("每个上报周期最多采集 720 个样本");
-    }
-    if input.network_interface.chars().count() > 160 {
-        return Some("统计网卡配置字段过长");
-    }
-    if !valid_agent_mirror(&input.agent_mirror) {
-        return Some("Agent 下载加速地址必须是无凭据、查询参数和片段的 HTTPS URL");
-    }
-    None
-}
-
-pub(crate) fn valid_agent_mirror(value: &str) -> bool {
-    let value = value.trim().trim_end_matches('/');
-    if value.is_empty() {
-        return true;
-    }
-    if value.len() > 2048
-        || value.chars().any(char::is_whitespace)
-        || !value
-            .chars()
-            .all(|character| character.is_ascii_alphanumeric() || "_./:@-".contains(character))
-    {
-        return false;
-    }
-    let Ok(url) = Url::parse(value) else {
-        return false;
-    };
-    if url.host_str().is_none()
-        || !url.username().is_empty()
-        || url.password().is_some()
-        || url.query().is_some()
-        || url.fragment().is_some()
-    {
-        return false;
-    }
-    if url.scheme() == "https" {
-        return true;
-    }
-    url.scheme() == "http"
-        && matches!(
-            url.host_str(),
-            Some(host) if host.eq_ignore_ascii_case("localhost") || host == "127.0.0.1" || host == "::1"
-        )
-}
-
-pub(crate) fn validate_report(report: &AgentReport) -> Option<&'static str> {
-    let floats = [
-        report.cpu,
-        report.load1,
-        report.load5,
-        report.load15,
-        report.net_in,
-        report.net_out,
-        report.gpu_usage,
-        report.disk_read_bps,
-        report.disk_write_bps,
-        report.disk_read_iops,
-        report.disk_write_iops,
-        report.disk_await_ms,
-        report.disk_utilization,
-    ];
-    if floats
-        .iter()
-        .any(|value| !value.is_finite() || *value < 0.0)
-    {
-        return Some("指标包含非法数值");
-    }
-    if !(0.0..=100.0).contains(&report.cpu) || !(0.0..=100.0).contains(&report.gpu_usage) {
-        return Some("CPU 或 GPU 使用率超出范围");
-    }
-    let counters = [
-        report.mem_used,
-        report.mem_total,
-        report.swap_used,
-        report.swap_total,
-        report.disk_used,
-        report.disk_total,
-        report.net_rx_total,
-        report.net_tx_total,
-        report.uptime,
-        report.processes,
-        report.tcp_connections,
-        report.udp_connections,
-        report.cpu_cores,
-    ];
-    if counters.iter().any(|value| *value < 0) {
-        return Some("计数指标不能为负数");
-    }
-    if report.mem_used > report.mem_total
-        || report.swap_used > report.swap_total
-        || report.disk_used > report.disk_total
-    {
-        return Some("已用资源不能超过总量");
-    }
-    if report.gpu_model.chars().count() > 240 {
-        return Some("GPU 型号字段过长");
-    }
-    if report.agent_version.chars().count() > 80 {
-        return Some("Agent 版本字段过长");
-    }
-    if report.ip_v4.chars().count() > 15
-        || (!report.ip_v4.is_empty() && report.ip_v4.parse::<Ipv4Addr>().is_err())
-        || report.ip_v6.chars().count() > 45
-        || (!report.ip_v6.is_empty() && report.ip_v6.parse::<Ipv6Addr>().is_err())
-    {
-        return Some("公网地址字段无效");
-    }
-    if report.disks.len() > 64
-        || report.gpus.len() > 32
-        || report.disks.iter().any(|disk| {
-            disk.name.chars().count() > 120
-                || disk.mount_point.chars().count() > 240
-                || disk.used < 0
-                || disk.total < 0
-                || disk.used > disk.total
-                || ![
-                    disk.read_bps,
-                    disk.write_bps,
-                    disk.read_iops,
-                    disk.write_iops,
-                    disk.await_ms,
-                    disk.utilization,
-                ]
-                .iter()
-                .all(|value| value.is_finite() && *value >= 0.0)
-        })
-        || report.gpus.iter().any(|gpu| {
-            gpu.model.chars().count() > 240
-                || gpu.memory_used < 0
-                || gpu.memory_total < 0
-                || gpu.memory_used > gpu.memory_total
-                || gpu
-                    .usage
-                    .is_some_and(|usage| !usage.is_finite() || !(0.0..=100.0).contains(&usage))
-        })
-    {
-        return Some("磁盘或 GPU 明细无效");
-    }
-    if report.latency_results.len() > 128
-        || report
-            .latency_results
-            .iter()
-            .map(|result| &result.task_id)
-            .collect::<HashSet<_>>()
-            .len()
-            != report.latency_results.len()
-    {
-        return Some("延迟结果列表无效");
-    }
-    if report.latency_results.iter().any(|result| {
-        result.task_id.is_empty()
-            || result.task_id.len() > 80
-            || result.timestamp <= 0
-            || !result.latency_ms.is_finite()
-            || !result.packet_loss.is_finite()
-            || !(-1.0..=100_000.0).contains(&result.latency_ms)
-            || !(0.0..=100.0).contains(&result.packet_loss)
-    }) {
-        return Some("延迟结果数值无效");
-    }
-    None
-}
-
-pub(crate) fn public_server(
-    server: ServerView,
-    latency: Vec<latency::LatencySample>,
-) -> PublicServer {
-    let disks = server
-        .disk_info
-        .as_deref()
-        .and_then(|value| serde_json::from_str::<Vec<AgentDiskMetric>>(value).ok())
-        .unwrap_or_default();
-    let gpus = server
-        .gpu_info
-        .as_deref()
-        .and_then(|value| serde_json::from_str::<Vec<AgentGpuMetric>>(value).ok())
-        .unwrap_or_default();
-    PublicServer {
-        id: server.id,
-        name: server.name,
-        region: server.region,
-        group_name: server.group_name,
-        tags: server.tags,
-        expires_at: server.expires_at,
-        traffic_limit: server.traffic_limit,
-        traffic_limit_type: server.traffic_limit_type,
-        price: server.price,
-        billing_cycle: server.billing_cycle,
-        currency: server.currency,
-        auto_renewal: server.auto_renewal != 0,
-        reset_day: server.reset_day,
-        timestamp: server.timestamp,
-        cpu: server.cpu,
-        load1: server.load1,
-        load5: server.load5,
-        load15: server.load15,
-        mem_used: server.mem_used,
-        mem_total: server.mem_total,
-        swap_used: server.swap_used,
-        swap_total: server.swap_total,
-        disk_used: server.disk_used,
-        disk_total: server.disk_total,
-        net_in: server.net_in,
-        net_out: server.net_out,
-        net_rx_total: server.net_rx_total,
-        net_tx_total: server.net_tx_total,
-        uptime: server.uptime,
-        processes: server.processes,
-        tcp_connections: server.tcp_connections,
-        udp_connections: server.udp_connections,
-        cpu_cores: server.cpu_cores,
-        cpu_model: server.cpu_model,
-        os: server.os,
-        kernel: server.kernel,
-        arch: server.arch,
-        virtualization: server.virtualization,
-        gpu_usage: server.gpu_usage,
-        gpu_model: server.gpu_model,
-        agent_version: server.agent_version,
-        disk_read_bps: server.disk_read_bps,
-        disk_write_bps: server.disk_write_bps,
-        disk_read_iops: server.disk_read_iops,
-        disk_write_iops: server.disk_write_iops,
-        disk_await_ms: server.disk_await_ms,
-        disk_utilization: server.disk_utilization,
-        disks,
-        gpus,
-        latency,
-    }
-}
-
-fn request_cookie(req: &Request, name: &str) -> Option<String> {
-    let raw = req.headers().get("Cookie").ok().flatten()?;
-    raw.split(';').find_map(|entry| {
-        let (key, value) = entry.trim().split_once('=')?;
-        (key == name).then(|| value.to_string())
-    })
-}
-
-pub(crate) fn client_ip(req: &Request) -> Option<String> {
-    req.headers()
-        .get("CF-Connecting-IP")
-        .ok()
-        .flatten()
-        .or_else(|| req.headers().get("X-Forwarded-For").ok().flatten())
-        .map(|value| value.split(',').next().unwrap_or("").trim().to_string())
-        .filter(|value| !value.is_empty())
-}
-
-fn rate_limit_binding(method: Method, path: &str) -> Option<&'static str> {
-    if method == Method::Post && matches!(path, "/api/admin/login" | "/api/turnstile/verify") {
-        Some("AUTH_RATE_LIMITER")
-    } else if method == Method::Get && path == "/api/agent/ws" {
-        Some("AGENT_RATE_LIMITER")
-    } else if path.starts_with("/api/") {
-        Some("API_RATE_LIMITER")
-    } else {
-        None
-    }
-}
-
-fn rate_limit_key(req: &Request) -> String {
-    let identity = client_ip(req).unwrap_or_else(|| {
-        req.headers()
-            .get("User-Agent")
-            .ok()
-            .flatten()
-            .filter(|value| !value.is_empty())
-            .unwrap_or_else(|| "anonymous".to_string())
-    });
-    sha256_hex(&identity)
-}
-
-fn agent_rate_limit_key(req: &Request) -> String {
-    bearer_token(req)
-        .filter(|value| !value.is_empty())
-        .map(|value| sha256_hex(&value))
-        .unwrap_or_else(|| rate_limit_key(req))
-}
-
-fn allow_on_rate_limit_failure(binding: &str) -> bool {
-    let _ = binding;
-    false
-}
-
-async fn request_within_rate_limit(env: &Env, binding: &str, key: String) -> bool {
-    let limiter = match env.rate_limiter(binding) {
-        Ok(value) => value,
-        Err(error) => {
-            console_warn!("rate limit binding {binding} unavailable: {error}");
-            return allow_on_rate_limit_failure(binding);
-        }
-    };
-    match limiter.limit(key).await {
-        Ok(outcome) => outcome.success,
-        Err(error) => {
-            console_warn!("rate limit check failed for {binding}: {error}");
-            allow_on_rate_limit_failure(binding)
-        }
-    }
-}
-
-pub(crate) fn requested_hours(req: &Request, maximum: i64) -> Result<i64> {
-    Ok(req
-        .url()?
-        .query_pairs()
-        .find(|(key, _)| key == "hours")
-        .and_then(|(_, value)| value.parse::<i64>().ok())
-        .unwrap_or(24)
-        .clamp(1, maximum))
-}
-
-pub(crate) fn history_cache_key(
-    request_url: &Url,
-    kind: &str,
-    server_id: &str,
-    hours: i64,
-    version: i64,
-) -> String {
-    let mut url = request_url.clone();
-    url.set_path(&format!("/__nodeflare-cache/{kind}/{server_id}"));
-    url.set_query(Some(&format!("hours={hours}&version={version}")));
-    url.set_fragment(None);
-    url.to_string()
-}
-
-pub(crate) fn history_cache_seconds(hours: i64) -> i64 {
-    match hours {
-        120.. => 10 * 60,
-        60.. => 5 * 60,
-        30.. => 3 * 60,
-        _ => 60,
-    }
-}
-
-async fn cached_history_response(key: &str) -> Option<Response> {
-    match Cache::default().get(key, false).await {
-        Ok(Some(response)) => {
-            let mut response = mutable_response(response).ok()?;
-            response
-                .headers_mut()
-                .set("Cache-Control", "no-store")
-                .ok()?;
-            response.headers_mut().set("X-Cache", "HIT").ok()?;
-            Some(response)
-        }
-        Ok(None) => None,
-        Err(error) => {
-            console_warn!("history cache read failed: {error}");
-            None
-        }
-    }
-}
-
-async fn store_history_response(key: &str, response: &mut Response, ttl: i64) {
-    if response.headers_mut().set("X-Cache", "MISS").is_err() {
-        return;
-    }
-    let Ok(mut cached) = response.cloned() else {
-        return;
-    };
-    if cached
-        .headers_mut()
-        .set(
-            "Cache-Control",
-            &format!("public, max-age={}", ttl.clamp(60, 10 * 60)),
-        )
-        .is_err()
-    {
-        return;
-    }
-    if let Err(error) = Cache::default().put(key, cached).await {
-        console_warn!("history cache write failed: {error}");
-    }
-}
-
-fn request_turnstile_proof(req: &Request) -> Option<String> {
-    request_cookie(req, "nodeflare_turnstile")
-}
-
-pub(crate) fn server_id(path: &str, prefix: &str) -> Option<String> {
-    let id = path.strip_prefix(prefix)?.trim_matches('/');
-    if id.is_empty() || id.contains('/') || id.len() > 80 {
-        None
-    } else {
-        Some(id.to_string())
-    }
-}
-
-async fn handle(req: Request, env: Env) -> Result<Response> {
-    let method = req.method();
-    let path = req.path();
-
-    if method == Method::Get {
-        if let Some(response) = routes::site::embedded_asset(&path)? {
-            return Ok(response);
-        }
-    }
-
-    let database = env.d1("DB")?;
-
-    if method == Method::Get && path == "/api/agent/ws" {
-        return routes::agent::websocket(req, &env, &database).await;
-    }
-
-    let default_name = env_text(&env, "SITE_NAME", "NodeFlare");
-    let default_threshold = env_number(&env, "OFFLINE_THRESHOLD_SECONDS", 180).clamp(30, 3600);
-    let default_retention =
-        env_number(&env, "HISTORY_RETENTION_DAYS", 30).clamp(1, db::MAX_HISTORY_RETENTION_DAYS);
-    let default_username = env_text(&env, "ADMIN_USERNAME", "");
-    let settings = db::settings(
-        &database,
-        &default_name,
-        default_threshold,
-        default_retention,
-        &default_username,
-    )
-    .await?;
-    let environment_turnstile_site_key = env_secret_text(&env, "TURNSTILE_SITE_KEY");
-    let environment_turnstile_secret_key = env_secret_text(&env, "TURNSTILE_SECRET_KEY");
-    let turnstile_site_key = if settings.turnstile_site_key.trim().is_empty() {
-        environment_turnstile_site_key.clone()
-    } else {
-        settings.turnstile_site_key.clone()
-    };
-    let turnstile_secret_key = if settings.turnstile_secret_key.trim().is_empty() {
-        environment_turnstile_secret_key.clone()
-    } else {
-        settings.turnstile_secret_key.clone()
-    };
-    let turnstile_configured =
-        !turnstile_site_key.trim().is_empty() && !turnstile_secret_key.trim().is_empty();
-    let public_turnstile_enabled = settings.turnstile_enabled && turnstile_configured;
-    let login_protection_enabled = settings.turnstile_login_enabled && turnstile_configured;
-
-    let admin = is_admin(&req, &env, &settings.admin_password_hash);
-    let turnstile_verified = !public_turnstile_enabled
-        || admin
-        || request_turnstile_proof(&req).is_some_and(|value| {
-            verify_turnstile_proof(&value, &env, &settings.admin_password_hash)
-        });
-
-    let context = routes::RouteContext {
-        env: env.clone(),
-        database,
-        settings,
-        admin,
-        turnstile_verified,
-        turnstile_site_key,
-        turnstile_secret_key,
-        public_turnstile_enabled,
-        login_protection_enabled,
-        environment_turnstile_site_key,
-        environment_turnstile_secret_key,
-        default_name,
-        default_threshold,
-        default_retention,
-        default_username,
-    };
-
-    let req = match routes::public::route(req, &context).await? {
-        routes::RouteOutcome::Handled(response) => return Ok(response),
-        routes::RouteOutcome::Unmatched(req) => req,
-    };
-    let req = match routes::admin::route(req, &context).await? {
-        routes::RouteOutcome::Handled(response) => return Ok(response),
-        routes::RouteOutcome::Unmatched(req) => req,
-    };
-    if path.starts_with("/api/") {
-        return error("接口不存在", 404);
-    }
-    let req = match routes::site::route(req, &context).await? {
-        routes::RouteOutcome::Handled(response) => return Ok(response),
-        routes::RouteOutcome::Unmatched(req) => req,
-    };
-    let response = env.assets("ASSETS")?.fetch_request(req).await?;
-    secure_public_response(mutable_response(response)?)
-}
-#[event(fetch, respond_with_errors)]
-async fn fetch(req: Request, env: Env, _ctx: Context) -> Result<Response> {
-    let method = req.method();
-    let method_name = format!("{method:?}");
-    let path = req.path();
-    let request_id = request_id(&req);
-    let request_url = req.url().ok();
-    let origin = req.headers().get("Origin").ok().flatten();
-
-    if path.starts_with("/api/")
-        && origin
-            .as_deref()
-            .zip(request_url.as_ref())
-            .is_some_and(|(origin, url)| !same_origin(origin, url))
-    {
-        return error("请求来源未获授权", 403);
-    }
-
-    if let Some(binding) = rate_limit_binding(method, &path) {
-        let key = if binding == "AGENT_RATE_LIMITER" {
-            agent_rate_limit_key(&req)
-        } else {
-            rate_limit_key(&req)
-        };
-        if !request_within_rate_limit(&env, binding, key).await {
-            return rate_limited();
-        }
-    }
-
-    match handle(req, env).await {
-        Ok(response) => Ok(response),
-        Err(err) => {
-            console_error!(
-                "{}",
-                serde_json::json!({
-                    "event": "request_failed",
-                    "request_id": request_id,
-                    "method": method_name,
-                    "path": path,
-                    "error": err.to_string(),
-                })
-            );
-            internal_error(&request_id)
-        }
-    }
-}
-
-#[event(scheduled)]
-async fn scheduled(_event: ScheduledEvent, env: Env, _ctx: ScheduleContext) {
-    let Ok(database) = env.d1("DB") else {
-        return;
-    };
-    let default_name = env_text(&env, "SITE_NAME", "NodeFlare");
-    let default_threshold = env_number(&env, "OFFLINE_THRESHOLD_SECONDS", 180).clamp(30, 3600);
-    let default_retention =
-        env_number(&env, "HISTORY_RETENTION_DAYS", 30).clamp(1, db::MAX_HISTORY_RETENTION_DAYS);
-    let default_username = env_text(&env, "ADMIN_USERNAME", "");
-    let settings = db::settings(
-        &database,
-        &default_name,
-        default_threshold,
-        default_retention,
-        &default_username,
-    )
-    .await;
-    let retention = match &settings {
-        Ok(settings) => settings.history_retention_days,
-        Err(_) => default_retention,
-    };
-    let current = now();
-    let last_cleanup = db::get_setting(&database, "last_history_cleanup")
-        .await
-        .ok()
-        .flatten()
-        .and_then(|value| value.parse::<i64>().ok())
-        .unwrap_or(0);
-    if current.saturating_sub(last_cleanup) >= db::HISTORY_ROTATION_INTERVAL_SECONDS {
-        if let Err(err) = db::cleanup_history(&database, retention).await {
-            console_error!("history cleanup failed: {err}");
-        } else {
-            let _ = db::save_setting(&database, "last_history_cleanup", &current.to_string()).await;
-        }
-        if let Err(err) = notify::cleanup(&database, current).await {
-            console_error!("notification cleanup failed: {err}");
-        }
-    }
-    match exchange::refresh(&database, current, false).await {
-        Ok((rates, true)) => console_log!(
-            "exchange rates updated from {} for {}",
-            rates.source,
-            rates.date
-        ),
-        Ok((_, false)) => {}
-        Err(err) => console_error!("exchange-rate refresh failed: {err}"),
-    }
-    let last_server_renewal = db::get_setting(&database, "last_server_renewal")
-        .await
-        .ok()
-        .flatten()
-        .and_then(|value| value.parse::<i64>().ok())
-        .unwrap_or(0);
-    if current.saturating_sub(last_server_renewal) >= SERVER_RENEWAL_INTERVAL_SECONDS {
-        if let Err(err) = notify::renew_servers(&database).await {
-            console_error!("server renewal failed: {err}");
-        } else {
-            let _ = db::save_setting(&database, "last_server_renewal", &current.to_string()).await;
-        }
-    }
-    if let Ok(settings) = settings {
-        if let Err(err) = notify::check_alerts(&database, &env, &settings).await {
-            console_error!("alert check failed: {err}");
-        }
-        if settings.notification_enabled {
-            if let Err(err) = notify::process_pending(&database, current).await {
-                console_error!("notification delivery processing failed: {err}");
-            }
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::{
-        allow_on_rate_limit_failure, history_cache_key, history_cache_seconds, rate_limit_binding,
-        rewrite_remote_theme_index, same_origin, submitted_secret, valid_agent_mirror,
-        valid_background_urls, valid_cloudflare_account_id, valid_cloudflare_api_token,
-        valid_password_derived, valid_ping_target, valid_public_asset_url, validate_latency_task,
-        validate_report, validate_server,
-    };
-    use crate::{
-        db::SECRET_MASK, models::AgentReport, models::LatencyTaskInput, models::ServerInput,
-    };
-    use worker::{Method, Url};
-
-    #[test]
-    fn validates_report_public_ips() {
-        let mut report = AgentReport::default();
-        assert_eq!(validate_report(&report), None);
-        report.ip_v4 = "203.0.113.7".into();
-        report.ip_v6 = "2001:db8::1".into();
-        assert_eq!(validate_report(&report), None);
-        report.ip_v4 = "2001:db8::1".into();
-        assert_eq!(validate_report(&report), Some("公网地址字段无效"));
-        report.ip_v4 = "203.0.113.7".into();
-        report.ip_v6 = "203.0.113.7".into();
-        assert_eq!(validate_report(&report), Some("公网地址字段无效"));
-        report.ip_v4 = "not-an-ip".into();
-        report.ip_v6.clear();
-        assert_eq!(validate_report(&report), Some("公网地址字段无效"));
-        report.ip_v4.clear();
-        assert_eq!(validate_report(&report), None);
-    }
-
-    #[test]
-    fn requires_public_ip_fields_in_agent_reports() {
-        for field in ["ip_v4", "ip_v6"] {
-            let mut report = serde_json::to_value(AgentReport::default()).unwrap();
-            report.as_object_mut().unwrap().remove(field);
-            assert!(serde_json::from_value::<AgentReport>(report).is_err());
-        }
-    }
-
-    #[test]
-    fn assigns_rate_limits_by_route() {
-        assert_eq!(
-            rate_limit_binding(Method::Post, "/api/admin/login"),
-            Some("AUTH_RATE_LIMITER")
-        );
-        assert_eq!(
-            rate_limit_binding(Method::Get, "/api/agent/ws"),
-            Some("AGENT_RATE_LIMITER")
-        );
-        assert_eq!(
-            rate_limit_binding(Method::Get, "/api/history/node-a"),
-            Some("API_RATE_LIMITER")
-        );
-        assert_eq!(rate_limit_binding(Method::Get, "/"), None);
-        assert!(!allow_on_rate_limit_failure("AUTH_RATE_LIMITER"));
-        assert!(!allow_on_rate_limit_failure("API_RATE_LIMITER"));
-    }
-
-    #[test]
-    fn builds_versioned_history_cache_keys() {
-        let request_url =
-            Url::parse("https://status.example/api/history/node-a?hours=1").expect("request URL");
-        assert_eq!(
-            history_cache_key(&request_url, "metrics", "node-a", 24, 7),
-            "https://status.example/__nodeflare-cache/metrics/node-a?hours=24&version=7"
-        );
-        assert!(same_origin("https://status.example", &request_url));
-        assert!(!same_origin("https://other.example", &request_url));
-        assert_eq!(history_cache_seconds(1), 60);
-        assert_eq!(history_cache_seconds(30), 180);
-        assert_eq!(history_cache_seconds(60), 300);
-        assert_eq!(history_cache_seconds(120), 600);
-    }
-
-    #[test]
-    fn bounds_samples_buffered_between_reports() {
-        let mut server = ServerInput {
-            name: "node-a".to_string(),
-            region: String::new(),
-            group_name: String::new(),
-            tags: String::new(),
-            hidden: false,
-            expires_at: None,
-            traffic_limit: 0,
-            traffic_limit_type: "sum".to_string(),
-            price: 0.0,
-            billing_cycle: 30,
-            currency: "CNY".to_string(),
-            auto_renewal: false,
-            network_interface: String::new(),
-            reset_day: 1,
-            report_interval: 3600,
-            collect_interval: 5,
-            rx_correction: 0,
-            tx_correction: 0,
-            agent_mirror: String::new(),
-            offline_notify_disabled: false,
-            auto_update: true,
-        };
-        assert_eq!(validate_server(&server), None);
-        server.collect_interval = 4;
-        assert_eq!(
-            validate_server(&server),
-            Some("每个上报周期最多采集 720 个样本")
-        );
-    }
-
-    #[test]
-    fn validates_agent_mirrors() {
-        for mirror in [
-            "",
-            "https://mirror.example.com",
-            "https://mirror.example.com/github",
-            "http://127.0.0.1:8080",
-            "http://localhost:8080",
-        ] {
-            assert!(
-                valid_agent_mirror(mirror),
-                "expected valid mirror: {mirror}"
-            );
-        }
-        for mirror in [
-            "https://",
-            "http://mirror.example.com",
-            "https://user@mirror.example.com",
-            "https://mirror.example.com/?token=secret",
-            "https://mirror.example.com/#fragment",
-            "https://bad host.example.com",
-        ] {
-            assert!(
-                !valid_agent_mirror(mirror),
-                "expected invalid mirror: {mirror}"
-            );
-        }
-    }
-
-    #[test]
-    fn validates_latency_targets() {
-        for target in ["gd-ct-dualstack.ip.zstaticcdn.com", "1.1.1.1"] {
-            assert!(valid_ping_target(target), "expected valid target: {target}");
-        }
-
-        for target in [
-            "",
-            "https://example.com",
-            "example.com/path",
-            "example.com:443",
-            "example.com:0",
-            "example.com:65536",
-            "example.com:abc",
-            "999.1.1.1",
-            "0.0.0.0",
-            "10.0.0.1",
-            "100.64.0.1",
-            "127.0.0.1",
-            "169.254.169.254",
-            "172.16.0.1",
-            "192.168.1.1",
-            "198.18.0.1",
-            "224.0.0.1",
-            "localhost",
-            "router.local",
-            "metadata.google.internal",
-            "Metadata.Google.INTERNAL",
-            "router_1.example.com",
-            "[::1]:443",
-            "bad host",
-            "-example.com",
-        ] {
-            assert!(
-                !valid_ping_target(target),
-                "expected invalid target: {target}"
-            );
-        }
-    }
-
-    #[test]
-    fn validates_dynamic_latency_tasks() {
-        let mut task = LatencyTaskInput {
-            name: "Cloudflare TCP".to_string(),
-            task_type: "tcp".to_string(),
-            target: "1.1.1.1".to_string(),
-            port: Some(443),
-            interval_seconds: 60,
-            default_enabled: false,
-            server_ids: vec!["node-a".to_string()],
-        };
-        assert_eq!(validate_latency_task(&task), None);
-
-        task.task_type = "icmp".to_string();
-        assert_eq!(validate_latency_task(&task), Some("ICMP 检测不使用端口"));
-        task.port = None;
-        task.server_ids.clear();
-        // 空服务器列表且未开默认分配：任务先保存，之后可再分配。
-        assert_eq!(validate_latency_task(&task), None);
-        task.default_enabled = true;
-        assert_eq!(validate_latency_task(&task), None);
-    }
-
-    #[test]
-    fn validates_cloudflare_usage_credentials() {
-        assert!(valid_cloudflare_account_id(""));
-        assert!(valid_cloudflare_account_id(SECRET_MASK));
-        assert!(valid_cloudflare_account_id(
-            "0123456789abcdef0123456789ABCDEF"
-        ));
-        assert!(!valid_cloudflare_account_id("account-id"));
-        assert!(valid_cloudflare_api_token(""));
-        assert!(valid_cloudflare_api_token("token_abc-123"));
-        assert!(!valid_cloudflare_api_token("token with spaces"));
-        assert_eq!(submitted_secret(Some(SECRET_MASK), "stored"), "stored");
-        assert_eq!(
-            submitted_secret(Some("replacement"), "stored"),
-            "replacement"
-        );
-        assert_eq!(submitted_secret(Some(""), "stored"), "");
-    }
-
-    #[test]
-    fn validates_client_password_derivations() {
-        assert!(valid_password_derived(&"a1".repeat(32)));
-        assert!(!valid_password_derived(&"A1".repeat(32)));
-        assert!(!valid_password_derived(&"a1".repeat(31)));
-        assert!(!valid_password_derived(&"zz".repeat(32)));
-    }
-
-    #[test]
-    fn validates_public_asset_urls() {
-        assert!(valid_public_asset_url(""));
-        assert!(valid_public_asset_url("https://cdn.example.com/logo.svg"));
-        assert!(valid_public_asset_url(
-            "https://cdn.example.com/background.webp?size=large#hero"
-        ));
-        assert!(!valid_public_asset_url("http://cdn.example.com/logo.svg"));
-        assert!(!valid_public_asset_url("/logo.svg"));
-        assert!(!valid_public_asset_url(
-            "https://user:pass@example.com/logo.svg"
-        ));
-
-        assert!(valid_background_urls(""));
-        assert!(valid_background_urls(
-            "https://cdn.example.com/light.webp | https://cdn.example.com/dark.webp"
-        ));
-        assert!(valid_background_urls(
-            "https://cdn.example.com/light.webp |"
-        ));
-        assert!(valid_background_urls("| https://cdn.example.com/dark.webp"));
-        assert!(!valid_background_urls("|"));
-        assert!(!valid_background_urls(
-            "https://cdn.example.com/a.webp | https://cdn.example.com/b.webp | https://cdn.example.com/c.webp"
-        ));
-        assert!(!valid_background_urls("javascript:alert(1)"));
-    }
-
-    #[test]
-    fn namespaces_remote_theme_assets() {
-        let html = r#"<script src="/assets/app.js"></script><link href='/assets/app.css'>"#;
-        assert_eq!(
-            rewrite_remote_theme_index(html, "/__theme-active/assets/"),
-            r#"<script src="/__theme-active/assets/app.js"></script><link href='/__theme-active/assets/app.css'>"#
-        );
-    }
-}
diff --git a/src/live.rs b/src/live.rs
deleted file mode 100644
index 4ca6077..0000000
--- a/src/live.rs
+++ /dev/null
@@ -1,2071 +0,0 @@
-use std::cell::RefCell;
-use std::collections::HashSet;
-
-use futures_util::{stream, StreamExt};
-use serde::{Deserialize, Serialize};
-use worker::*;
-
-use crate::db::{
-    AgentLiveContext, AlertMetricRow, HistoryMetricAggregate, HISTORY_WRITE_INTERVAL_SECONDS,
-};
-use crate::latency::LatencyMetricAggregates;
-use crate::models::{AgentConfigView, AgentReport, AlertRuleView, HistoryPoint, ServerView};
-
-const MAX_LIVE_SAMPLES: usize = 720;
-const MAX_LIVE_LATENCY_RESULTS: usize = 4096;
-const AGENT_MESSAGE_WINDOW_SECONDS: i64 = 60;
-const MAX_AGENT_MESSAGES_PER_WINDOW: u32 = 120;
-const MAX_AGENT_SAMPLES_PER_WINDOW: u32 = 1440;
-const MAX_AGENT_BYTES_PER_WINDOW: u32 = 4 * 1024 * 1024;
-const LIVE_REPORT_DIVISOR: i64 = 15;
-const MAX_SERIALIZED_ATTACHMENT_BYTES: usize = 15 * 1024;
-const MAX_CACHED_LIVE_SAMPLES: usize = 32;
-const MAX_CACHED_LIVE_BYTES: usize = 12 * 1024;
-const MAX_CACHED_REPLAY_UPDATES: usize = 64;
-const MAX_CACHED_REPLAY_BYTES: usize = 256 * 1024;
-const CACHED_LIVE_TTL_SECONDS: i64 = 5 * 60;
-/// 一次唤醒后「相信首页有人在看」的基础时长。成功的转发会顺带续期，所以只要
-/// 上报还在继续，这个窗口就自己续下去；viewer 关掉后最多多发一次就会被判定收回。
-const DASHBOARD_PRESENCE_TTL_SECONDS: i64 = 5 * 60;
-const ALERT_WINDOW_SECONDS: i64 = 24 * 60 * 60;
-const MAX_ALERT_WINDOW_SAMPLES: usize = 24 * 60 + 1;
-const ALERT_STORAGE_PREFIX: &str = "resource-alert:";
-const DASHBOARD_HUB_NAME: &str = "dashboard";
-
-/// 机器身份字段，一批里逐条重复且几乎不变，实时样本不带它们。
-///
-/// 前端 `mergeServerLive` 是 `{ ...server, ...live.metrics }`，样本里缺的键会露出
-/// bootstrap 那份，而 `SERVER_SELECT` 从 `server_latest_state.latest_json` 里
-/// `json_extract` 出这七个字段；两处任一改动都要跟着这份契约对齐。
-///
-/// 代价：agent 升级后这些值要等下一次 bootstrap 轮询才刷新。
-/// 只影响展示，不影响任何判定 —— 告警和持久化读的是 `AgentReport` 本身，
-/// 剥离只发生在发往浏览器的副本上。
-const BROWSER_OMITTED_REPORT_FIELDS: [&str; 9] = [
-    "cpu_model",
-    "os",
-    "kernel",
-    "arch",
-    "virtualization",
-    "gpu_model",
-    "agent_version",
-    "ip_v4",
-    "ip_v6",
-];
-
-fn server_hub_name(server_id: &str) -> String {
-    format!("server:{server_id}")
-}
-
-#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
-struct AlertWindowSample(i64, u32, f64, f64, f64, f64, f64);
-
-impl AlertWindowSample {
-    fn from_history(point: &HistoryPoint) -> Self {
-        let memory = if point.mem_total > 0 {
-            point.mem_used as f64 * 100.0 / point.mem_total as f64
-        } else {
-            0.0
-        };
-        let disk = if point.disk_total > 0 {
-            point.disk_used as f64 * 100.0 / point.disk_total as f64
-        } else {
-            0.0
-        };
-        Self(
-            point.timestamp / 60 * 60,
-            1,
-            point.cpu,
-            memory,
-            disk,
-            point.net_in / 1_048_576.0,
-            point.net_out / 1_048_576.0,
-        )
-    }
-
-    fn merge(&mut self, other: &Self) {
-        self.1 = self.1.saturating_add(other.1);
-        self.2 += other.2;
-        self.3 += other.3;
-        self.4 += other.4;
-        self.5 = self.5.max(other.5);
-        self.6 = self.6.max(other.6);
-    }
-
-    fn metric(&self, metric: &str) -> Option<f64> {
-        let count = f64::from(self.1.max(1));
-        match metric {
-            "cpu" => Some(self.2 / count),
-            "memory" => Some(self.3 / count),
-            "disk" => Some(self.4 / count),
-            "net_in" => Some(self.5),
-            "net_out" => Some(self.6),
-            _ => None,
-        }
-    }
-}
-
-#[derive(Debug, Deserialize, Serialize)]
-struct AlertRecordRequest {
-    server_id: String,
-    point: HistoryPoint,
-}
-
-#[derive(Debug, Deserialize, Serialize)]
-struct AlertEvaluationServer {
-    id: String,
-    name: String,
-    report_interval: i64,
-}
-
-#[derive(Debug, Deserialize, Serialize)]
-struct AlertEvaluationRequest {
-    current_time: i64,
-    rules: Vec<AlertRuleView>,
-    servers: Vec<AlertEvaluationServer>,
-}
-
-#[derive(Debug, Deserialize, Serialize)]
-pub struct AlertEvaluationValue {
-    pub rule_id: String,
-    pub row: AlertMetricRow,
-}
-
-fn alert_storage_key(server_id: &str) -> String {
-    format!("{ALERT_STORAGE_PREFIX}{server_id}")
-}
-
-fn update_alert_window(samples: &mut Vec<AlertWindowSample>, point: &HistoryPoint) {
-    let sample = AlertWindowSample::from_history(point);
-    let newest = samples
-        .last()
-        .map(|value| value.0)
-        .unwrap_or(sample.0)
-        .max(sample.0);
-    let cutoff = newest - ALERT_WINDOW_SECONDS;
-    if sample.0 < cutoff {
-        return;
-    }
-    match samples.binary_search_by_key(&sample.0, |value| value.0) {
-        Ok(index) => samples[index].merge(&sample),
-        Err(index) => samples.insert(index, sample),
-    }
-    samples.retain(|value| value.0 >= cutoff);
-    if samples.len() > MAX_ALERT_WINDOW_SAMPLES {
-        let overflow = samples.len() - MAX_ALERT_WINDOW_SAMPLES;
-        samples.drain(..overflow);
-    }
-}
-
-fn evaluate_alert_window(
-    samples: &[AlertWindowSample],
-    rule: &AlertRuleView,
-    server: &AlertEvaluationServer,
-    current_time: i64,
-) -> Option<AlertMetricRow> {
-    let since = current_time - rule.duration_minutes.clamp(1, 1440) * 60;
-    let mut values = samples
-        .iter()
-        .filter(|sample| sample.0 >= since && sample.0 <= current_time)
-        .filter_map(|sample| sample.metric(&rule.metric).map(|value| (sample.0, value)));
-    let (first_timestamp, first_value) = values.next()?;
-    let mut count = 1_i64;
-    let mut last_timestamp = first_timestamp;
-    let mut total = first_value;
-    let mut minimum = first_value;
-    for (timestamp, value) in values {
-        count += 1;
-        last_timestamp = timestamp;
-        total += value;
-        minimum = minimum.min(value);
-    }
-    Some(AlertMetricRow {
-        server_id: server.id.clone(),
-        name: server.name.clone(),
-        value: if rule.aggregation == "continuous" {
-            minimum
-        } else {
-            total / count as f64
-        },
-        sample_count: count,
-        first_timestamp,
-        last_timestamp,
-        report_interval: server.report_interval,
-    })
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-struct AgentLiveBatch {
-    #[serde(rename = "type")]
-    message_type: String,
-    #[serde(rename = "batchId")]
-    batch_id: String,
-    samples: Vec<AgentReport>,
-}
-
-#[derive(Clone, Debug, Deserialize, Serialize)]
-struct TrafficAttachment {
-    #[serde(rename = "d")]
-    reset_day: i64,
-    #[serde(rename = "sd")]
-    state_reset_day: i64,
-    #[serde(rename = "st")]
-    timestamp: i64,
-    #[serde(rename = "c")]
-    cycle_key: i64,
-    #[serde(rename = "rr")]
-    raw_rx: i64,
-    #[serde(rename = "rt")]
-    raw_tx: i64,
-    #[serde(rename = "ur")]
-    used_rx: i64,
-    #[serde(rename = "ut")]
-    used_tx: i64,
-    #[serde(rename = "rc")]
-    rx_correction: i64,
-    #[serde(rename = "tc")]
-    tx_correction: i64,
-}
-
-#[derive(Debug, Clone, Deserialize, Serialize)]
-struct CachedLiveSample {
-    ts: i64,
-    data: serde_json::Value,
-}
-
-#[derive(Clone, Debug, Default, Deserialize, Serialize)]
-struct AgentMessageBudget {
-    #[serde(rename = "w")]
-    window_started_at: i64,
-    #[serde(rename = "m")]
-    messages: u32,
-    #[serde(rename = "s")]
-    samples: u32,
-    #[serde(rename = "b")]
-    bytes: u32,
-}
-
-fn consume_agent_message_budget(
-    budget: &mut AgentMessageBudget,
-    now: i64,
-    message_bytes: usize,
-    sample_count: usize,
-) -> bool {
-    if budget.window_started_at <= 0
-        || now < budget.window_started_at
-        || now.saturating_sub(budget.window_started_at) >= AGENT_MESSAGE_WINDOW_SECONDS
-    {
-        *budget = AgentMessageBudget {
-            window_started_at: now,
-            ..AgentMessageBudget::default()
-        };
-    }
-    budget.messages = budget.messages.saturating_add(1);
-    budget.samples = budget
-        .samples
-        .saturating_add(u32::try_from(sample_count).unwrap_or(u32::MAX));
-    budget.bytes = budget
-        .bytes
-        .saturating_add(u32::try_from(message_bytes).unwrap_or(u32::MAX));
-    budget.messages <= MAX_AGENT_MESSAGES_PER_WINDOW
-        && budget.samples <= MAX_AGENT_SAMPLES_PER_WINDOW
-        && budget.bytes <= MAX_AGENT_BYTES_PER_WINDOW
-}
-
-#[derive(Clone, Debug, Deserialize, Serialize)]
-struct SocketAttachment {
-    #[serde(rename = "r")]
-    role: String,
-    #[serde(rename = "s")]
-    server_id: Option<String>,
-    #[serde(rename = "h")]
-    hidden: bool,
-    #[serde(rename = "ri")]
-    report_interval: i64,
-    #[serde(rename = "ci")]
-    collect_interval: i64,
-    #[serde(rename = "dw")]
-    last_d1_write_at: i64,
-    #[serde(rename = "pw")]
-    persisted_through: i64,
-    #[serde(rename = "df")]
-    d1_flush: Option<D1FlushSnapshot>,
-    #[serde(rename = "tr")]
-    traffic: Option<TrafficAttachment>,
-    #[serde(rename = "mh")]
-    history_aggregate: HistoryMetricAggregate,
-    #[serde(rename = "lh")]
-    latency_aggregates: LatencyMetricAggregates,
-    #[serde(rename = "ls")]
-    latest_samples: Vec<CachedLiveSample>,
-    #[serde(rename = "lr")]
-    latest_received_at: i64,
-    #[serde(rename = "mb")]
-    message_budget: AgentMessageBudget,
-    /// 全局 dashboard 上「相信有人在看」的截止时间。为 0 或已过期就不再向
-    /// dashboard DO 转发，省掉那次按 1:1 全价计费的 DO 间 fetch。
-    #[serde(rename = "dp")]
-    dashboard_present_until: i64,
-}
-
-#[derive(Clone, Debug, Deserialize, Serialize)]
-struct D1FlushSnapshot {
-    #[serde(rename = "h")]
-    history: HistoryMetricAggregate,
-    #[serde(rename = "l")]
-    latency: LatencyMetricAggregates,
-}
-
-fn begin_d1_flush(attachment: &mut SocketAttachment) -> Option<D1FlushSnapshot> {
-    if let Some(snapshot) = attachment.d1_flush.clone() {
-        return Some(snapshot);
-    }
-    attachment.history_aggregate.point()?;
-    let snapshot = D1FlushSnapshot {
-        history: std::mem::take(&mut attachment.history_aggregate),
-        latency: std::mem::take(&mut attachment.latency_aggregates),
-    };
-    attachment.d1_flush = Some(snapshot.clone());
-    Some(snapshot)
-}
-
-fn finish_d1_flush(
-    attachment: &mut SocketAttachment,
-    succeeded: bool,
-    persisted_at: i64,
-    persisted_through: i64,
-) {
-    let Some(snapshot) = attachment.d1_flush.take() else {
-        return;
-    };
-    if succeeded {
-        attachment.last_d1_write_at = persisted_at;
-        attachment.persisted_through = attachment.persisted_through.max(persisted_through);
-    } else {
-        attachment.history_aggregate.merge(snapshot.history);
-        attachment.latency_aggregates.merge(snapshot.latency);
-    }
-}
-
-fn agent_wss_interval_ms(attachment: &SocketAttachment, realtime_active: bool) -> i64 {
-    let collect = attachment.collect_interval.clamp(1, 60);
-    let report_interval = attachment.report_interval.clamp(15, 3600);
-    let realtime_seconds =
-        report_interval.saturating_add(LIVE_REPORT_DIVISOR - 1) / LIVE_REPORT_DIVISOR;
-    let realtime = realtime_seconds.clamp(1, 60).max(collect) * 1000;
-    if realtime_active {
-        return realtime;
-    }
-    report_interval * 1000
-}
-
-/// 至少覆盖两个上报周期，否则上报间隔比 TTL 还长时窗口会在两次上报之间过期，
-/// 导致明明有人在看却停止转发。`report_interval` 接受未 clamp 的原始值。
-fn dashboard_presence_ttl(report_interval: i64) -> i64 {
-    report_interval
-        .clamp(15, 3600)
-        .saturating_mul(2)
-        .max(DASHBOARD_PRESENCE_TTL_SECONDS)
-}
-
-/// 处理一条上报期间会 await（转发、写 D1），这中间可能插进来一次 `hint-agents`
-/// 把 presence 写新。落盘前用这个函数判一下：字段被别人动过就让对方赢，否则写
-/// 我们自己算出来的值。只取 max 不行——收回 presence 时要能写回更小的值。
-fn merge_dashboard_presence(current: i64, observed: i64, computed: i64) -> i64 {
-    if current != observed {
-        current
-    } else {
-        computed
-    }
-}
-
-fn agent_realtime_active(
-    hidden: bool,
-    dashboard_present_until: i64,
-    current_time: i64,
-    global_dashboard_active: bool,
-    local_dashboard_active: bool,
-) -> bool {
-    !hidden
-        && (global_dashboard_active
-            || current_time < dashboard_present_until
-            || local_dashboard_active)
-}
-
-fn next_d1_write_ms(attachment: &SocketAttachment, now: i64) -> i64 {
-    if attachment.d1_flush.is_some() {
-        return 0;
-    }
-    let interval = HISTORY_WRITE_INTERVAL_SECONDS;
-    if attachment.last_d1_write_at <= 0 {
-        return interval * 1000;
-    }
-    attachment
-        .last_d1_write_at
-        .saturating_add(interval)
-        .saturating_sub(now)
-        .max(0)
-        .saturating_mul(1000)
-}
-
-fn live_ack_payload(
-    timestamp: i64,
-    persisted: bool,
-    persistence_error: bool,
-    persisted_through: i64,
-    next_d1_write_after_ms: i64,
-    next_wss_report_after_ms: i64,
-    realtime_hint: bool,
-) -> Result<String> {
-    Ok(serde_json::to_string(&serde_json::json!({
-        "type": "ack",
-        "ts": timestamp,
-        "persisted": persisted,
-        "persistenceError": persistence_error,
-        "persistedThroughTs": persisted_through,
-        "nextD1WriteAfterMs": next_d1_write_after_ms,
-        "nextWssReportAfterMs": next_wss_report_after_ms,
-        "realtimeHint": realtime_hint
-    }))?)
-}
-
-fn agent_config_payload(timestamp: i64, config: &AgentConfigView) -> Result<String> {
-    Ok(serde_json::to_string(&serde_json::json!({
-        "type": "config",
-        "ts": timestamp,
-        "config": config
-    }))?)
-}
-
-fn apply_live_traffic(report: &mut AgentReport, traffic: &mut TrafficAttachment) {
-    if report.timestamp <= traffic.timestamp {
-        report.net_rx_total = traffic.used_rx.saturating_add(traffic.rx_correction).max(0);
-        report.net_tx_total = traffic.used_tx.saturating_add(traffic.tx_correction).max(0);
-        return;
-    }
-    let cycle_key = crate::db::traffic_cycle_key(report.timestamp, traffic.reset_day);
-    if traffic.timestamp <= 0 {
-        traffic.used_rx = report.net_rx_total;
-        traffic.used_tx = report.net_tx_total;
-    } else if cycle_key != traffic.cycle_key || traffic.reset_day != traffic.state_reset_day {
-        traffic.used_rx = 0;
-        traffic.used_tx = 0;
-    } else {
-        let rx_delta = if report.net_rx_total >= traffic.raw_rx {
-            report.net_rx_total - traffic.raw_rx
-        } else {
-            report.net_rx_total
-        };
-        let tx_delta = if report.net_tx_total >= traffic.raw_tx {
-            report.net_tx_total - traffic.raw_tx
-        } else {
-            report.net_tx_total
-        };
-        traffic.used_rx = traffic.used_rx.saturating_add(rx_delta);
-        traffic.used_tx = traffic.used_tx.saturating_add(tx_delta);
-    }
-    traffic.cycle_key = cycle_key;
-    traffic.state_reset_day = traffic.reset_day;
-    traffic.timestamp = report.timestamp;
-    traffic.raw_rx = report.net_rx_total;
-    traffic.raw_tx = report.net_tx_total;
-    report.net_rx_total = traffic.used_rx.saturating_add(traffic.rx_correction).max(0);
-    report.net_tx_total = traffic.used_tx.saturating_add(traffic.tx_correction).max(0);
-}
-
-fn batch_update_parts_at(
-    server_id: &str,
-    reports: &[AgentReport],
-    traffic: &mut TrafficAttachment,
-    envelope_timestamp: i64,
-) -> Result<(String, Vec<CachedLiveSample>)> {
-    let mut reports = reports.to_vec();
-    reports.sort_by_key(|report| report.timestamp);
-    let mut samples = Vec::with_capacity(reports.len());
-    for mut report in reports {
-        apply_live_traffic(&mut report, traffic);
-        let timestamp = report.timestamp;
-        let mut data = serde_json::to_value(report)?;
-        if let Some(data) = data.as_object_mut() {
-            data.remove("timestamp");
-            for key in BROWSER_OMITTED_REPORT_FIELDS {
-                data.remove(key);
-            }
-        }
-        samples.push(CachedLiveSample {
-            ts: timestamp,
-            data,
-        });
-    }
-    let payload = serde_json::to_string(&serde_json::json!({
-        "type": "batchUpdate",
-        "ts": envelope_timestamp,
-        "updates": [{
-            "serverId": server_id,
-            "samples": &samples
-        }]
-    }))?;
-    Ok((payload, samples))
-}
-
-fn trim_cached_live_samples(samples: &mut Vec<CachedLiveSample>) {
-    if samples.len() > MAX_CACHED_LIVE_SAMPLES {
-        let overflow = samples.len() - MAX_CACHED_LIVE_SAMPLES;
-        samples.drain(..overflow);
-    }
-    while samples.len() > 1
-        && serde_json::to_vec(samples)
-            .map(|encoded| encoded.len() > MAX_CACHED_LIVE_BYTES)
-            .unwrap_or(true)
-    {
-        samples.remove(0);
-    }
-    if samples.len() == 1
-        && serde_json::to_vec(samples)
-            .map(|encoded| encoded.len() > MAX_CACHED_LIVE_BYTES)
-            .unwrap_or(true)
-    {
-        samples.clear();
-    }
-}
-
-fn trim_socket_attachment(attachment: &mut SocketAttachment) -> bool {
-    while !attachment.latest_samples.is_empty()
-        && serde_json::to_vec(attachment)
-            .map(|encoded| encoded.len() > MAX_SERIALIZED_ATTACHMENT_BYTES)
-            .unwrap_or(true)
-    {
-        attachment.latest_samples.remove(0);
-    }
-    serde_json::to_vec(attachment)
-        .map(|encoded| encoded.len() <= MAX_SERIALIZED_ATTACHMENT_BYTES)
-        .unwrap_or(false)
-}
-
-fn cached_update_value(
-    attachment: &SocketAttachment,
-    now: i64,
-    server_id: Option<&str>,
-) -> Option<serde_json::Value> {
-    let agent_server_id = attachment.server_id.as_deref()?;
-    if attachment.role != "agent"
-        || attachment.hidden
-        || server_id.is_some_and(|requested| requested != agent_server_id)
-        || attachment.latest_received_at <= 0
-        || attachment.latest_samples.is_empty()
-    {
-        return None;
-    }
-    let age = now.saturating_sub(attachment.latest_received_at);
-    if !(0..=CACHED_LIVE_TTL_SECONDS).contains(&age) {
-        return None;
-    }
-    Some(serde_json::json!({
-        "serverId": agent_server_id,
-        "reportAgeMs": age.saturating_mul(1000),
-        "samples": &attachment.latest_samples
-    }))
-}
-
-fn agent_attachment(
-    server_id: String,
-    hidden: bool,
-    context: AgentLiveContext,
-) -> SocketAttachment {
-    SocketAttachment {
-        role: "agent".to_string(),
-        server_id: Some(server_id),
-        hidden,
-        report_interval: context.report_interval.clamp(15, 3600),
-        collect_interval: context.collect_interval.clamp(1, 60),
-        last_d1_write_at: context.last_persisted_at,
-        persisted_through: context.last_persisted_at,
-        d1_flush: None,
-        traffic: Some(TrafficAttachment {
-            reset_day: context.reset_day.clamp(1, 31),
-            state_reset_day: context.traffic_reset_day.clamp(1, 31),
-            timestamp: context.traffic_timestamp,
-            cycle_key: context.cycle_key,
-            raw_rx: context.raw_rx,
-            raw_tx: context.raw_tx,
-            used_rx: context.used_rx,
-            used_tx: context.used_tx,
-            rx_correction: context.rx_correction,
-            tx_correction: context.tx_correction,
-        }),
-        history_aggregate: HistoryMetricAggregate::default(),
-        latency_aggregates: LatencyMetricAggregates::default(),
-        latest_samples: Vec::new(),
-        latest_received_at: 0,
-        message_budget: AgentMessageBudget::default(),
-        // agent 可能连在 viewer 之后，此时没有 hint 会送过来。初始窗口同样按
-        // report_interval 覆盖两个上报周期，慢上报的 agent 才不会在首个上报
-        // 之前过期；没人在看的话首批转发会返回 false 并立即收回。
-        dashboard_present_until: crate::now()
-            .saturating_add(dashboard_presence_ttl(context.report_interval)),
-    }
-}
-
-fn required_i64_header(req: &Request, name: &str) -> Result<i64> {
-    req.headers()
-        .get(name)?
-        .and_then(|value| value.parse::<i64>().ok())
-        .ok_or_else(|| Error::RustError(format!("missing or invalid {name}")))
-}
-
-fn live_context_from_headers(req: &Request) -> Result<AgentLiveContext> {
-    Ok(AgentLiveContext {
-        report_interval: required_i64_header(req, "X-Live-Report-Interval")?,
-        collect_interval: required_i64_header(req, "X-Live-Collect-Interval")?,
-        reset_day: required_i64_header(req, "X-Live-Reset-Day")?,
-        cycle_key: required_i64_header(req, "X-Live-Cycle-Key")?,
-        traffic_reset_day: required_i64_header(req, "X-Live-Traffic-Reset-Day")?,
-        traffic_timestamp: required_i64_header(req, "X-Live-Traffic-Timestamp")?,
-        raw_rx: required_i64_header(req, "X-Live-Raw-Rx")?,
-        raw_tx: required_i64_header(req, "X-Live-Raw-Tx")?,
-        used_rx: required_i64_header(req, "X-Live-Used-Rx")?,
-        used_tx: required_i64_header(req, "X-Live-Used-Tx")?,
-        rx_correction: required_i64_header(req, "X-Live-Rx-Correction")?,
-        tx_correction: required_i64_header(req, "X-Live-Tx-Correction")?,
-        last_persisted_at: required_i64_header(req, "X-Live-Last-Persisted-At")?,
-    })
-}
-
-fn dashboard_attachment() -> SocketAttachment {
-    SocketAttachment {
-        role: "dashboard".to_string(),
-        server_id: None,
-        hidden: false,
-        report_interval: 0,
-        collect_interval: 0,
-        last_d1_write_at: 0,
-        persisted_through: 0,
-        d1_flush: None,
-        traffic: None,
-        history_aggregate: HistoryMetricAggregate::default(),
-        latency_aggregates: LatencyMetricAggregates::default(),
-        latest_samples: Vec::new(),
-        latest_received_at: 0,
-        message_budget: AgentMessageBudget::default(),
-        dashboard_present_until: 0,
-    }
-}
-
-#[durable_object(websocket)]
-pub struct LiveHub {
-    state: State,
-    env: Env,
-    active_d1_flushes: RefCell<HashSet<String>>,
-}
-
-struct ActiveD1FlushGuard<'a> {
-    active: &'a RefCell<HashSet<String>>,
-    server_id: String,
-}
-
-impl<'a> ActiveD1FlushGuard<'a> {
-    fn acquire(active: &'a RefCell<HashSet<String>>, server_id: &str) -> Option<Self> {
-        if !active.borrow_mut().insert(server_id.to_string()) {
-            return None;
-        }
-        Some(Self {
-            active,
-            server_id: server_id.to_string(),
-        })
-    }
-}
-
-impl Drop for ActiveD1FlushGuard<'_> {
-    fn drop(&mut self) {
-        self.active.borrow_mut().remove(&self.server_id);
-    }
-}
-
-impl LiveHub {
-    /// `Ok(false)` 是 dashboard 明确回答「没人在看」，会被用来收回 presence；
-    /// `Err` 只是这一次没送到，不能当成没人在看，否则一次瞬时故障就要等到下次
-    /// 唤醒才能恢复推送。
-    async fn broadcast_to_global_dashboard(&self, server_id: &str, payload: &str) -> Result<bool> {
-        let namespace = self.env.durable_object("LIVE_HUB")?;
-        let stub = namespace.id_from_name(DASHBOARD_HUB_NAME)?.get_stub()?;
-        let headers = Headers::new();
-        headers.set("X-Server-ID", server_id)?;
-        let mut init = RequestInit::new();
-        init.with_method(Method::Post)
-            .with_headers(headers)
-            .with_body(Some(worker::wasm_bindgen::JsValue::from_str(payload)));
-        let req = Request::new_with_init("https://live.internal/push", &init)?;
-        let mut response = stub.fetch_with_request(req).await?;
-        ensure_live_success(&response, "global-push")?;
-        response.json::<bool>().await
-    }
-
-    async fn record_global_alert_point(&self, server_id: &str, point: &HistoryPoint) {
-        let result = async {
-            let response = post_live_action(
-                &self.env,
-                "record-alert-sample",
-                "record-alert-sample",
-                &serde_json::to_string(&AlertRecordRequest {
-                    server_id: server_id.to_string(),
-                    point: point.clone(),
-                })?,
-            )
-            .await?;
-            ensure_live_success(&response, "record-alert-sample")
-        }
-        .await;
-        if let Err(error) = result {
-            console_warn!("global alert window write failed for {server_id}: {error:?}");
-        }
-    }
-
-    fn dashboard_active_for(&self, server_id: &str) -> bool {
-        !self.state.get_websockets_with_tag("all").is_empty()
-            || !self
-                .state
-                .get_websockets_with_tag(&format!("server:{server_id}"))
-                .is_empty()
-    }
-
-    fn hint_agents(&self, server_id: Option<&str>, force_realtime: bool) {
-        let sockets = server_id.map_or_else(
-            || self.state.get_websockets_with_tag("agents"),
-            |server_id| {
-                self.state
-                    .get_websockets_with_tag(&format!("agent:{server_id}"))
-            },
-        );
-        let now = crate::now();
-        for socket in sockets {
-            let Ok(Some(mut attachment)) = socket.deserialize_attachment::<SocketAttachment>()
-            else {
-                continue;
-            };
-            let Some(agent_server_id) = attachment.server_id.as_deref() else {
-                continue;
-            };
-            let realtime_active = !attachment.hidden
-                && (force_realtime || self.dashboard_active_for(agent_server_id));
-            // 只有 `/api/live/wake` 扇出来的唤醒才代表首页有 viewer；本地详情页
-            // viewer 走的是同一个 DO 内广播，不需要转发。
-            if force_realtime {
-                attachment.dashboard_present_until =
-                    now.saturating_add(dashboard_presence_ttl(attachment.report_interval));
-                if socket.serialize_attachment(&attachment).is_err() {
-                    let _ = socket.close(Some(1011), Some("attachment write failed"));
-                    continue;
-                }
-            }
-            let Ok(payload) = live_ack_payload(
-                now,
-                false,
-                false,
-                attachment.persisted_through,
-                next_d1_write_ms(&attachment, now),
-                agent_wss_interval_ms(&attachment, realtime_active),
-                true,
-            ) else {
-                continue;
-            };
-            if socket.send_with_str(&payload).is_err() {
-                let _ = socket.close(Some(1011), Some("send failed"));
-            }
-        }
-    }
-
-    fn send_cached_updates(dashboard: &WebSocket, now: i64, updates: &[serde_json::Value]) -> bool {
-        let Ok(payload) = serde_json::to_string(&serde_json::json!({
-            "type": "batchUpdate",
-            "ts": now,
-            "cached": true,
-            "updates": updates
-        })) else {
-            return false;
-        };
-        if dashboard.send_with_str(&payload).is_ok() {
-            return true;
-        }
-        let _ = dashboard.close(Some(1011), Some("send failed"));
-        false
-    }
-
-    fn replay_latest(&self, dashboard: &WebSocket, server_id: Option<&str>) {
-        let sockets = server_id.map_or_else(
-            || self.state.get_websockets_with_tag("agents"),
-            |server_id| {
-                self.state
-                    .get_websockets_with_tag(&format!("agent:{server_id}"))
-            },
-        );
-        let now = crate::now();
-        let mut updates = Vec::new();
-        let mut encoded_bytes = 0_usize;
-        for socket in sockets {
-            let Some(update) = socket
-                .deserialize_attachment::<SocketAttachment>()
-                .ok()
-                .flatten()
-                .and_then(|attachment| cached_update_value(&attachment, now, server_id))
-            else {
-                continue;
-            };
-            let Ok(update_bytes) = serde_json::to_vec(&update).map(|encoded| encoded.len()) else {
-                continue;
-            };
-            if !updates.is_empty()
-                && (updates.len() >= MAX_CACHED_REPLAY_UPDATES
-                    || encoded_bytes.saturating_add(update_bytes) > MAX_CACHED_REPLAY_BYTES)
-            {
-                if !Self::send_cached_updates(dashboard, now, &updates) {
-                    return;
-                }
-                updates.clear();
-                encoded_bytes = 0;
-            }
-            encoded_bytes = encoded_bytes.saturating_add(update_bytes);
-            updates.push(update);
-        }
-        if !updates.is_empty() {
-            Self::send_cached_updates(dashboard, now, &updates);
-        }
-    }
-
-    async fn record_alert_point(&self, server_id: &str, point: &HistoryPoint) -> Result<()> {
-        if server_id.is_empty() || server_id.len() > 80 || server_id.contains('/') {
-            return Err(Error::RustError(
-                "invalid alert server identity".to_string(),
-            ));
-        }
-        let key = alert_storage_key(server_id);
-        let storage = self.state.storage();
-        let mut samples = storage
-            .get::<Vec<AlertWindowSample>>(&key)
-            .await?
-            .unwrap_or_default();
-        update_alert_window(&mut samples, point);
-        storage.put(&key, &samples).await
-    }
-
-    async fn evaluate_alerts(
-        &self,
-        request: &AlertEvaluationRequest,
-    ) -> Result<Vec<AlertEvaluationValue>> {
-        let enabled = request.rules.iter().any(|rule| rule.enabled);
-        if !enabled {
-            return Ok(Vec::new());
-        }
-        let storage = self.state.storage();
-        let mut values = Vec::new();
-        for server in &request.servers {
-            let applicable_rules = request
-                .rules
-                .iter()
-                .filter(|rule| {
-                    rule.enabled
-                        && (rule.server_ids.is_empty()
-                            || rule.server_ids.iter().any(|id| id == &server.id))
-                })
-                .collect::<Vec<_>>();
-            if applicable_rules.is_empty() {
-                continue;
-            }
-            let samples = storage
-                .get::<Vec<AlertWindowSample>>(&alert_storage_key(&server.id))
-                .await?
-                .unwrap_or_default();
-            if samples.is_empty() {
-                continue;
-            }
-            for rule in applicable_rules {
-                if let Some(row) =
-                    evaluate_alert_window(&samples, rule, server, request.current_time)
-                {
-                    values.push(AlertEvaluationValue {
-                        rule_id: rule.id.clone(),
-                        row,
-                    });
-                }
-            }
-        }
-        Ok(values)
-    }
-}
-
-impl DurableObject for LiveHub {
-    fn new(state: State, env: Env) -> Self {
-        if let Ok(pair) = WebSocketRequestResponsePair::new("ping", "pong") {
-            state.set_websocket_auto_response(&pair);
-        }
-        Self {
-            state,
-            env,
-            active_d1_flushes: RefCell::new(HashSet::new()),
-        }
-    }
-
-    async fn fetch(&self, mut req: Request) -> Result<Response> {
-        if req.method() == Method::Post {
-            match req.headers().get("X-Live-Action")?.as_deref() {
-                Some("disconnect-agents") => {
-                    let server_ids = req.json::<Vec<String>>().await?;
-                    for server_id in server_ids {
-                        if server_id.is_empty() || server_id.len() > 80 || server_id.contains('/') {
-                            continue;
-                        }
-                        for socket in self
-                            .state
-                            .get_websockets_with_tag(&format!("agent:{server_id}"))
-                        {
-                            let _ = socket.close(Some(1008), Some("server configuration changed"));
-                        }
-                    }
-                    return Response::empty();
-                }
-                Some("hint-agents") => {
-                    self.hint_agents(None, true);
-                    return Response::empty();
-                }
-                Some("record-alert-sample") => {
-                    let record = req.json::<AlertRecordRequest>().await?;
-                    self.record_alert_point(&record.server_id, &record.point)
-                        .await?;
-                    return Response::empty();
-                }
-                Some("evaluate-alerts") => {
-                    let request = req.json::<AlertEvaluationRequest>().await?;
-                    return Response::from_json(&self.evaluate_alerts(&request).await?);
-                }
-                Some("clear-alert-windows") => {
-                    self.state.storage().delete_all().await?;
-                    return Response::empty();
-                }
-                Some("remove-alert-samples") => {
-                    let server_ids = req.json::<Vec<String>>().await?;
-                    let keys = server_ids
-                        .into_iter()
-                        .filter(|id| !id.is_empty() && id.len() <= 80 && !id.contains('/'))
-                        .map(|id| alert_storage_key(&id))
-                        .collect::<Vec<_>>();
-                    if !keys.is_empty() {
-                        self.state.storage().delete_multiple(keys).await?;
-                    }
-                    return Response::empty();
-                }
-                _ => {}
-            }
-            let payload = req.text().await?;
-            if payload.len() > 1024 * 1024 {
-                return Response::error("live broadcast payload too large", 413);
-            }
-            let server_id = req.headers().get("X-Server-ID")?.unwrap_or_default();
-            let mut sockets = self.state.get_websockets_with_tag("all");
-            if !server_id.is_empty() {
-                sockets.extend(
-                    self.state
-                        .get_websockets_with_tag(&format!("server:{server_id}")),
-                );
-            }
-            let dashboard_active = !sockets.is_empty();
-            for socket in sockets {
-                if socket.send_with_str(&payload).is_err() {
-                    let _ = socket.close(Some(1011), Some("send failed"));
-                }
-            }
-            return Response::from_json(&dashboard_active);
-        }
-
-        let is_upgrade = req
-            .headers()
-            .get("Upgrade")?
-            .map(|value| value.eq_ignore_ascii_case("websocket"))
-            .unwrap_or(false);
-        if !is_upgrade {
-            return Response::error("WebSocket upgrade required", 426);
-        }
-
-        let pair = WebSocketPair::new()?;
-        if let Some(server_id) = req.headers().get("X-Live-Agent-ID")? {
-            if server_id.is_empty() || server_id.len() > 80 || server_id.contains('/') {
-                return Response::error("Invalid live Agent identity", 400);
-            }
-            let hidden = req
-                .headers()
-                .get("X-Live-Agent-Hidden")?
-                .is_some_and(|value| value == "1");
-            let context = match live_context_from_headers(&req) {
-                Ok(context) => context,
-                Err(_) => return Response::error("Invalid live Agent context", 400),
-            };
-            let database = self.env.d1("DB")?;
-            let Some(config) = crate::db::agent_config(&database, &server_id).await? else {
-                return Response::error("Agent server not found", 404);
-            };
-            let config_payload = agent_config_payload(crate::now(), &config)?;
-            let agent_tag = format!("agent:{server_id}");
-            for existing in self.state.get_websockets_with_tag(&agent_tag) {
-                let _ = existing.close(Some(1008), Some("replaced by a newer Agent connection"));
-            }
-            pair.server.serialize_attachment(agent_attachment(
-                server_id.clone(),
-                hidden,
-                context,
-            ))?;
-            self.state
-                .accept_websocket_with_tags(&pair.server, &["agents", agent_tag.as_str()]);
-            pair.server.send_with_str(&config_payload)?;
-            return Response::from_websocket(pair.client);
-        }
-        let server_id = req
-            .url()?
-            .query_pairs()
-            .find_map(|(key, value)| (key == "server_id").then(|| value.to_string()))
-            .filter(|value| !value.is_empty() && value.len() <= 80 && !value.contains('/'));
-        let tag = server_id
-            .as_ref()
-            .map_or_else(|| "all".to_string(), |id| format!("server:{id}"));
-        pair.server.serialize_attachment(dashboard_attachment())?;
-        self.state.accept_websocket_with_tags(&pair.server, &[&tag]);
-        self.replay_latest(&pair.server, server_id.as_deref());
-        self.hint_agents(server_id.as_deref(), false);
-        Response::from_websocket(pair.client)
-    }
-
-    async fn websocket_message(
-        &self,
-        ws: WebSocket,
-        message: WebSocketIncomingMessage,
-    ) -> Result<()> {
-        let Some(mut attachment) = ws.deserialize_attachment::<SocketAttachment>()? else {
-            return Ok(());
-        };
-        if attachment.role != "agent" {
-            return ws.close(Some(1008), Some("dashboard messages are not accepted"));
-        }
-        let WebSocketIncomingMessage::String(message) = message else {
-            return ws.close(
-                Some(1003),
-                Some("binary live metric payload is not accepted"),
-            );
-        };
-        if message.len() > 1024 * 1024 {
-            return ws.close(Some(1009), Some("live metric payload too large"));
-        }
-        let Ok(batch) = serde_json::from_str::<AgentLiveBatch>(&message) else {
-            return ws.close(Some(1007), Some("invalid live metric payload"));
-        };
-        if batch.message_type != "update"
-            || batch.samples.is_empty()
-            || batch.samples.len() > MAX_LIVE_SAMPLES
-            || !crate::db::valid_report_batch_id(&batch.batch_id)
-        {
-            return ws.close(Some(1007), Some("invalid live metric batch"));
-        }
-        let received_at = crate::now();
-        if !consume_agent_message_budget(
-            &mut attachment.message_budget,
-            received_at,
-            message.len(),
-            batch.samples.len(),
-        ) {
-            return ws.close(Some(1008), Some("live metric message rate exceeded"));
-        }
-        let mut latency_result_count = 0usize;
-        for report in &batch.samples {
-            if report.timestamp <= 0
-                || (report.timestamp - received_at).abs() > 7200
-                || crate::validate_report(report).is_some()
-            {
-                return ws.close(Some(1007), Some("invalid live metric sample"));
-            }
-            latency_result_count =
-                latency_result_count.saturating_add(report.latency_results.len());
-        }
-        if latency_result_count > MAX_LIVE_LATENCY_RESULTS {
-            return ws.close(Some(1009), Some("too many live latency results"));
-        }
-        let Some(server_id) = attachment.server_id.clone() else {
-            return ws.close(Some(1008), Some("missing server identity"));
-        };
-        let unpersisted_reports =
-            crate::db::reports_after(&batch.samples, attachment.persisted_through);
-        let mut traffic = attachment
-            .traffic
-            .take()
-            .ok_or_else(|| Error::RustError("missing live traffic state".to_string()))?;
-        let previous_traffic_timestamp = traffic.timestamp;
-        let fresh_reports = crate::db::reports_after(&batch.samples, previous_traffic_timestamp);
-        let latency_results = fresh_reports
-            .iter()
-            .flat_map(|report| report.latency_results.iter().cloned())
-            .collect::<Vec<_>>();
-        let (payload, mut cached_samples) =
-            batch_update_parts_at(&server_id, &fresh_reports, &mut traffic, received_at)?;
-        trim_cached_live_samples(&mut cached_samples);
-        let traffic_state = crate::db::TrafficCounterState {
-            cycle_key: traffic.cycle_key,
-            reset_day: traffic.state_reset_day,
-            timestamp: traffic.timestamp,
-            raw_rx: traffic.raw_rx,
-            raw_tx: traffic.raw_tx,
-            used_rx: traffic.used_rx,
-            used_tx: traffic.used_tx,
-        };
-        attachment.traffic = Some(traffic);
-        if !fresh_reports.is_empty() {
-            attachment.latest_samples = cached_samples;
-            attachment.latest_received_at = received_at;
-            attachment.history_aggregate.extend(&fresh_reports);
-            attachment
-                .latency_aggregates
-                .extend(&latency_results, received_at);
-        }
-
-        let due_for_d1 = received_at.saturating_sub(attachment.last_d1_write_at)
-            >= HISTORY_WRITE_INTERVAL_SECONDS;
-        let should_flush =
-            !unpersisted_reports.is_empty() && (due_for_d1 || attachment.d1_flush.is_some());
-        let mut flush_guard = None;
-        let mut flush = None;
-        if should_flush {
-            // Acquire before any external await below. Durable Object events may
-            // interleave while broadcasting or writing D1.
-            if let Some(guard) = ActiveD1FlushGuard::acquire(&self.active_d1_flushes, &server_id) {
-                let database = self.env.d1("DB")?;
-                flush = begin_d1_flush(&mut attachment).map(|snapshot| (database, snapshot));
-                if flush.is_some() {
-                    flush_guard = Some(guard);
-                }
-            }
-        }
-        if flush.is_some() {
-            if !trim_socket_attachment(&mut attachment) {
-                return ws.close(Some(1011), Some("live state exceeds attachment limit"));
-            }
-            ws.serialize_attachment(&attachment)?;
-        }
-
-        // 本地广播是同一个 DO 内的内存操作，不计费，无条件做。
-        let mut global_dashboard_active = false;
-        let observed_presence = attachment.dashboard_present_until;
-        let mut computed_presence = observed_presence;
-        if !fresh_reports.is_empty() && !attachment.hidden {
-            let mut sockets = self.state.get_websockets_with_tag("all");
-            sockets.extend(
-                self.state
-                    .get_websockets_with_tag(&format!("server:{server_id}")),
-            );
-            for dashboard in sockets {
-                if dashboard.send_with_str(&payload).is_err() {
-                    let _ = dashboard.close(Some(1011), Some("send failed"));
-                }
-            }
-            // 转发是一次 DO 间 fetch，按 1:1 全价计一个 request，而上报本身只算
-            // 1/20。相信没人在看时就整个跳过。
-            if received_at < observed_presence {
-                match self
-                    .broadcast_to_global_dashboard(&server_id, &payload)
-                    .await
-                {
-                    Ok(active) => {
-                        global_dashboard_active = active;
-                        computed_presence = if active {
-                            received_at
-                                .saturating_add(dashboard_presence_ttl(attachment.report_interval))
-                        } else {
-                            0
-                        };
-                    }
-                    Err(error) => {
-                        console_warn!("global live broadcast failed for {server_id}: {error:?}");
-                    }
-                }
-            }
-        }
-
-        let mut persisted = false;
-        let mut persistence_error = false;
-        let mut attachment_serialized = false;
-        if let Some((database, snapshot)) = flush.take() {
-            let history_point = snapshot
-                .history
-                .point()
-                .ok_or_else(|| Error::RustError("missing live history aggregate".to_string()))?;
-            let sample_count = snapshot.history.sample_count();
-            let metrics_result = crate::db::save_reports_with_history(
-                &database,
-                &server_id,
-                crate::db::ReportBatchRef {
-                    reports: &unpersisted_reports,
-                    id: &batch.batch_id,
-                },
-                &history_point,
-                sample_count,
-                &traffic_state,
-                &snapshot.latency,
-            )
-            .await;
-            let (write_succeeded, newly_written) = match metrics_result {
-                Err(error) => {
-                    console_warn!("live D1 write failed for {server_id}: {error:?}");
-                    persistence_error = true;
-                    (false, false)
-                }
-                Ok(inserted) => (true, inserted),
-            };
-
-            let Some(mut current_attachment) = ws.deserialize_attachment::<SocketAttachment>()?
-            else {
-                return ws.close(Some(1011), Some("missing live state after D1 write"));
-            };
-            if current_attachment.role != "agent"
-                || current_attachment.server_id.as_deref() != Some(server_id.as_str())
-            {
-                return ws.close(Some(1011), Some("invalid live state after D1 write"));
-            }
-            finish_d1_flush(
-                &mut current_attachment,
-                write_succeeded,
-                received_at,
-                traffic_state.timestamp,
-            );
-            current_attachment.dashboard_present_until = merge_dashboard_presence(
-                current_attachment.dashboard_present_until,
-                observed_presence,
-                computed_presence,
-            );
-            if !trim_socket_attachment(&mut current_attachment) {
-                return ws.close(Some(1011), Some("live state exceeds attachment limit"));
-            }
-            ws.serialize_attachment(&current_attachment)?;
-            attachment = current_attachment;
-            attachment_serialized = true;
-            persisted = write_succeeded;
-            drop(flush_guard.take());
-
-            if newly_written {
-                match crate::db::has_enabled_alert_rules(&database).await {
-                    Ok(true) => {
-                        self.record_global_alert_point(&server_id, &history_point)
-                            .await;
-                    }
-                    Ok(false) => {}
-                    Err(error) => {
-                        console_warn!("enabled alert rule check failed for {server_id}: {error:?}");
-                    }
-                }
-            }
-        }
-        if !attachment_serialized {
-            // 转发那一步 await 过，期间可能插进来一次 hint 改了 presence，所以
-            // 以 socket 上的当前值为准重新判一次。先合并再生成 ACK，避免刚收到的
-            // realtime hint 被这条上报的普通间隔覆盖。
-            let current_presence = ws
-                .deserialize_attachment::<SocketAttachment>()?
-                .map_or(observed_presence, |current| current.dashboard_present_until);
-            attachment.dashboard_present_until =
-                merge_dashboard_presence(current_presence, observed_presence, computed_presence);
-            if !trim_socket_attachment(&mut attachment) {
-                return ws.close(Some(1011), Some("live state exceeds attachment limit"));
-            }
-            ws.serialize_attachment(&attachment)?;
-        } else if let Some(current_attachment) = ws.deserialize_attachment::<SocketAttachment>()? {
-            // D1 写完之后还可能 await 告警处理；若此时收到 hint，以刚落到 socket
-            // 上的 attachment 为准，不能再用较旧的局部副本生成 ACK。
-            attachment = current_attachment;
-        }
-        let realtime_active = agent_realtime_active(
-            attachment.hidden,
-            attachment.dashboard_present_until,
-            received_at,
-            global_dashboard_active,
-            self.dashboard_active_for(&server_id),
-        );
-        let next_wss_ms = agent_wss_interval_ms(&attachment, realtime_active);
-        let next_d1_ms = if persisted {
-            HISTORY_WRITE_INTERVAL_SECONDS * 1000
-        } else {
-            next_d1_write_ms(&attachment, received_at)
-        };
-        let ack = live_ack_payload(
-            received_at,
-            persisted,
-            persistence_error,
-            attachment.persisted_through,
-            next_d1_ms,
-            next_wss_ms,
-            false,
-        )?;
-        ws.send_with_str(&ack)?;
-        Ok(())
-    }
-
-    async fn websocket_close(
-        &self,
-        ws: WebSocket,
-        code: usize,
-        reason: String,
-        _was_clean: bool,
-    ) -> Result<()> {
-        match outbound_close_code(code) {
-            Some(code) => ws.close(Some(code), Some(reason)),
-            None => ws.close(None, None::<&str>),
-        }
-    }
-
-    async fn websocket_error(&self, ws: WebSocket, _error: Error) -> Result<()> {
-        ws.close(Some(1011), Some("socket error"))
-    }
-}
-
-fn outbound_close_code(code: usize) -> Option<u16> {
-    let code = u16::try_from(code).ok()?;
-    ((1000..=4999).contains(&code) && !matches!(code, 1004..=1006 | 1015)).then_some(code)
-}
-
-async fn post_live_action(env: &Env, path: &str, action: &str, body: &str) -> Result<Response> {
-    let namespace = env.durable_object("LIVE_HUB")?;
-    let stub = namespace.id_from_name(DASHBOARD_HUB_NAME)?.get_stub()?;
-    let headers = Headers::new();
-    headers.set("Content-Type", "application/json")?;
-    headers.set("X-Live-Action", action)?;
-    let mut init = RequestInit::new();
-    init.with_method(Method::Post)
-        .with_headers(headers)
-        .with_body(Some(worker::wasm_bindgen::JsValue::from_str(body)));
-    let req = Request::new_with_init(&format!("https://live.internal/{path}"), &init)?;
-    stub.fetch_with_request(req).await
-}
-
-fn ensure_live_success(response: &Response, action: &str) -> Result<()> {
-    let status = response.status_code();
-    if (200..300).contains(&status) {
-        Ok(())
-    } else {
-        Err(Error::RustError(format!(
-            "live action {action} returned HTTP {status}"
-        )))
-    }
-}
-
-pub async fn evaluate_resource_alerts(
-    env: &Env,
-    rules: &[AlertRuleView],
-    servers: &[ServerView],
-    current_time: i64,
-) -> Result<Vec<AlertEvaluationValue>> {
-    let request = AlertEvaluationRequest {
-        current_time,
-        rules: rules.to_vec(),
-        servers: servers
-            .iter()
-            .filter(|server| server.hidden == 0)
-            .map(|server| AlertEvaluationServer {
-                id: server.id.clone(),
-                name: server.name.clone(),
-                report_interval: server.report_interval,
-            })
-            .collect(),
-    };
-    let mut response = post_live_action(
-        env,
-        "evaluate-alerts",
-        "evaluate-alerts",
-        &serde_json::to_string(&request)?,
-    )
-    .await?;
-    ensure_live_success(&response, "evaluate-alerts")?;
-    response.json::<Vec<AlertEvaluationValue>>().await
-}
-
-pub async fn clear_alert_windows(env: &Env) -> Result<()> {
-    let response =
-        post_live_action(env, "clear-alert-windows", "clear-alert-windows", "{}").await?;
-    ensure_live_success(&response, "clear-alert-windows")?;
-    Ok(())
-}
-
-pub async fn remove_alert_samples(env: &Env, server_ids: &[String]) -> Result<()> {
-    if server_ids.is_empty() {
-        return Ok(());
-    }
-    let response = post_live_action(
-        env,
-        "remove-alert-samples",
-        "remove-alert-samples",
-        &serde_json::to_string(server_ids)?,
-    )
-    .await?;
-    ensure_live_success(&response, "remove-alert-samples")?;
-    Ok(())
-}
-
-fn copied_request_headers(req: &Request) -> Result<Headers> {
-    let headers = Headers::new();
-    for (name, value) in req.headers().entries() {
-        headers.append(&name, &value)?;
-    }
-    Ok(headers)
-}
-
-fn request_with_headers(req: &Request, headers: Headers) -> Result<Request> {
-    let mut init = RequestInit::new();
-    init.with_method(req.method()).with_headers(headers);
-    Request::new_with_init(req.url()?.as_str(), &init)
-}
-
-pub async fn disconnect_agents(env: &Env, server_ids: &[String]) -> Result<()> {
-    if server_ids.is_empty() {
-        return Ok(());
-    }
-    let namespace = env.durable_object("LIVE_HUB")?;
-    for server_id in server_ids {
-        let stub = namespace
-            .id_from_name(&server_hub_name(server_id))?
-            .get_stub()?;
-        let headers = Headers::new();
-        headers.set("Content-Type", "application/json")?;
-        headers.set("X-Live-Action", "disconnect-agents")?;
-        let mut init = RequestInit::new();
-        init.with_method(Method::Post)
-            .with_headers(headers)
-            .with_body(Some(worker::wasm_bindgen::JsValue::from_str(
-                &serde_json::to_string(std::slice::from_ref(server_id))?,
-            )));
-        let req = Request::new_with_init("https://live.internal/disconnect-agents", &init)?;
-        let response = stub.fetch_with_request(req).await?;
-        ensure_live_success(&response, "disconnect-agents")?;
-    }
-    Ok(())
-}
-
-pub async fn wake_agents(env: &Env, server_ids: &[String]) -> Result<()> {
-    if server_ids.is_empty() {
-        return Ok(());
-    }
-    let namespace = env.durable_object("LIVE_HUB")?;
-    let results = stream::iter(server_ids.iter())
-        .map(|server_id| {
-            let namespace = &namespace;
-            async move {
-                let stub = namespace
-                    .id_from_name(&server_hub_name(server_id))?
-                    .get_stub()?;
-                let headers = Headers::new();
-                headers.set("X-Live-Action", "hint-agents")?;
-                let mut init = RequestInit::new();
-                init.with_method(Method::Post).with_headers(headers);
-                let req = Request::new_with_init("https://live.internal/hint-agents", &init)?;
-                let response = stub.fetch_with_request(req).await?;
-                ensure_live_success(&response, "hint-agents")
-            }
-        })
-        .buffer_unordered(6)
-        .collect::<Vec<_>>()
-        .await;
-    for result in results {
-        result?;
-    }
-    Ok(())
-}
-
-pub async fn upgrade(req: Request, env: &Env) -> Result<Response> {
-    let namespace = env.durable_object("LIVE_HUB")?;
-    let server_id = req
-        .url()?
-        .query_pairs()
-        .find_map(|(key, value)| (key == "server_id").then(|| value.to_string()))
-        .filter(|value| !value.is_empty() && value.len() <= 80 && !value.contains('/'));
-    let hub_name = server_id
-        .as_deref()
-        .map(server_hub_name)
-        .unwrap_or_else(|| DASHBOARD_HUB_NAME.to_string());
-    let stub = namespace.id_from_name(&hub_name)?.get_stub()?;
-    let headers = copied_request_headers(&req)?;
-    headers.delete("X-Live-Agent-ID")?;
-    headers.delete("X-Live-Agent-Hidden")?;
-    for header in [
-        "X-Live-Report-Interval",
-        "X-Live-Collect-Interval",
-        "X-Live-Reset-Day",
-        "X-Live-Cycle-Key",
-        "X-Live-Traffic-Reset-Day",
-        "X-Live-Traffic-Timestamp",
-        "X-Live-Raw-Rx",
-        "X-Live-Raw-Tx",
-        "X-Live-Used-Rx",
-        "X-Live-Used-Tx",
-        "X-Live-Rx-Correction",
-        "X-Live-Tx-Correction",
-        "X-Live-Last-Persisted-At",
-    ] {
-        headers.delete(header)?;
-    }
-    let req = request_with_headers(&req, headers)?;
-    stub.fetch_with_request(req).await
-}
-
-pub async fn upgrade_agent(
-    req: Request,
-    env: &Env,
-    server_id: &str,
-    hidden: bool,
-    context: AgentLiveContext,
-) -> Result<Response> {
-    let namespace = env.durable_object("LIVE_HUB")?;
-    let stub = namespace
-        .id_from_name(&server_hub_name(server_id))?
-        .get_stub()?;
-    let headers = copied_request_headers(&req)?;
-    headers.set("X-Live-Agent-ID", server_id)?;
-    headers.set("X-Live-Agent-Hidden", if hidden { "1" } else { "0" })?;
-    headers.set(
-        "X-Live-Report-Interval",
-        &context.report_interval.to_string(),
-    )?;
-    headers.set(
-        "X-Live-Collect-Interval",
-        &context.collect_interval.to_string(),
-    )?;
-    headers.set("X-Live-Reset-Day", &context.reset_day.to_string())?;
-    headers.set("X-Live-Cycle-Key", &context.cycle_key.to_string())?;
-    headers.set(
-        "X-Live-Traffic-Reset-Day",
-        &context.traffic_reset_day.to_string(),
-    )?;
-    headers.set(
-        "X-Live-Traffic-Timestamp",
-        &context.traffic_timestamp.to_string(),
-    )?;
-    headers.set("X-Live-Raw-Rx", &context.raw_rx.to_string())?;
-    headers.set("X-Live-Raw-Tx", &context.raw_tx.to_string())?;
-    headers.set("X-Live-Used-Rx", &context.used_rx.to_string())?;
-    headers.set("X-Live-Used-Tx", &context.used_tx.to_string())?;
-    headers.set("X-Live-Rx-Correction", &context.rx_correction.to_string())?;
-    headers.set("X-Live-Tx-Correction", &context.tx_correction.to_string())?;
-    headers.set(
-        "X-Live-Last-Persisted-At",
-        &context.last_persisted_at.to_string(),
-    )?;
-    headers.delete("Authorization")?;
-    let req = request_with_headers(&req, headers)?;
-    stub.fetch_with_request(req).await
-}
-
-#[cfg(test)]
-mod tests {
-    use super::{
-        agent_realtime_active, agent_wss_interval_ms, apply_live_traffic, batch_update_parts_at,
-        begin_d1_flush, cached_update_value, consume_agent_message_budget, dashboard_presence_ttl,
-        finish_d1_flush, live_ack_payload, merge_dashboard_presence, next_d1_write_ms,
-        outbound_close_code, trim_cached_live_samples, trim_socket_attachment, update_alert_window,
-        ActiveD1FlushGuard, AgentMessageBudget, AlertEvaluationServer, AlertWindowSample,
-        CachedLiveSample, SocketAttachment, TrafficAttachment, ALERT_WINDOW_SECONDS,
-        BROWSER_OMITTED_REPORT_FIELDS, CACHED_LIVE_TTL_SECONDS, DASHBOARD_PRESENCE_TTL_SECONDS,
-        MAX_AGENT_BYTES_PER_WINDOW, MAX_AGENT_MESSAGES_PER_WINDOW, MAX_AGENT_SAMPLES_PER_WINDOW,
-        MAX_CACHED_LIVE_BYTES, MAX_CACHED_LIVE_SAMPLES, MAX_SERIALIZED_ATTACHMENT_BYTES,
-    };
-    use crate::db::HistoryMetricAggregate;
-    use crate::latency::LatencyMetricAggregates;
-    use crate::models::{AgentLatencyResult, AgentReport, AlertRuleView, HistoryPoint};
-    use std::cell::RefCell;
-    use std::collections::HashSet;
-
-    fn alert_point(timestamp: i64, cpu: f64, net_in: f64) -> HistoryPoint {
-        HistoryPoint {
-            timestamp,
-            cpu,
-            mem_used: 50,
-            mem_total: 100,
-            disk_used: 25,
-            disk_total: 100,
-            net_in,
-            net_out: net_in / 2.0,
-            ..HistoryPoint::default()
-        }
-    }
-
-    /// correction 置 0，隔离出纯累加行为；correction 的效果由
-    /// live_payload_contains_cycle_adjusted_traffic_and_latency 覆盖。
-    #[test]
-    fn folds_traffic_counters_and_ignores_replayed_samples() {
-        let mut traffic = TrafficAttachment {
-            reset_day: 1,
-            state_reset_day: 1,
-            timestamp: 0,
-            cycle_key: 0,
-            raw_rx: 0,
-            raw_tx: 0,
-            used_rx: 0,
-            used_tx: 0,
-            rx_correction: 0,
-            tx_correction: 0,
-        };
-        let fold = |traffic: &mut TrafficAttachment, timestamp, rx, tx| {
-            let mut report = AgentReport {
-                timestamp,
-                net_rx_total: rx,
-                net_tx_total: tx,
-                ..AgentReport::default()
-            };
-            apply_live_traffic(&mut report, traffic);
-            report
-        };
-
-        // 首个样本只立基线，不把历史总量算成本周期用量。
-        fold(&mut traffic, 100, 1_000, 2_000);
-        assert_eq!((traffic.used_rx, traffic.used_tx), (1_000, 2_000));
-
-        // 正常增长按差值累加。
-        fold(&mut traffic, 101, 1_300, 2_500);
-        assert_eq!((traffic.used_rx, traffic.used_tx), (1_300, 2_500));
-
-        // agent 重启导致计数器回绕：新值小于上次原始值，整值计入而不是算负数。
-        fold(&mut traffic, 102, 20, 40);
-        assert_eq!((traffic.used_rx, traffic.used_tx), (1_320, 2_540));
-
-        // 重放的旧样本不得改状态，返回值仍是当前累计量。
-        let replayed = fold(&mut traffic, 99, 9_999, 9_999);
-        assert_eq!(
-            (traffic.timestamp, traffic.used_rx, traffic.used_tx),
-            (102, 1_320, 2_540)
-        );
-        assert_eq!(
-            (replayed.net_rx_total, replayed.net_tx_total),
-            (1_320, 2_540)
-        );
-
-        // 改了重置日 → 周期换了，用量归零重新起算。
-        traffic.reset_day = 2;
-        fold(&mut traffic, 103, 30, 50);
-        assert_eq!((traffic.used_rx, traffic.used_tx), (0, 0));
-        assert_eq!(traffic.state_reset_day, 2);
-    }
-
-    #[test]
-    fn filters_reserved_and_invalid_websocket_close_codes() {
-        assert_eq!(outbound_close_code(1000), Some(1000));
-        assert_eq!(outbound_close_code(1011), Some(1011));
-        assert_eq!(outbound_close_code(4000), Some(4000));
-        assert_eq!(outbound_close_code(999), None);
-        assert_eq!(outbound_close_code(1004), None);
-        assert_eq!(outbound_close_code(1005), None);
-        assert_eq!(outbound_close_code(1006), None);
-        assert_eq!(outbound_close_code(1015), None);
-        assert_eq!(outbound_close_code(5000), None);
-    }
-
-    #[test]
-    fn dashboard_presence_ttl_covers_two_report_cycles() {
-        // 接受未 clamp 的原始间隔：过短取下限，过长按 3600 封顶，
-        // 默认间隔落在 5 分钟基础窗口内。
-        assert_eq!(dashboard_presence_ttl(1), DASHBOARD_PRESENCE_TTL_SECONDS);
-        assert_eq!(dashboard_presence_ttl(60), DASHBOARD_PRESENCE_TTL_SECONDS);
-        assert_eq!(dashboard_presence_ttl(300), 600);
-        assert_eq!(dashboard_presence_ttl(7200), 7200);
-    }
-
-    #[test]
-    fn merge_dashboard_presence_yields_to_concurrent_writes() {
-        // 字段没被并发改过：写自己的计算值，续期和收回都要生效。
-        assert_eq!(merge_dashboard_presence(500, 500, 700), 700);
-        assert_eq!(merge_dashboard_presence(500, 500, 0), 0);
-        // 处理期间被 hint 改写：让位，即使自己算出来要收回。
-        assert_eq!(merge_dashboard_presence(900, 500, 0), 900);
-    }
-
-    #[test]
-    fn valid_dashboard_presence_keeps_agent_realtime_after_transfer_failure() {
-        assert!(agent_realtime_active(false, 700, 500, false, false));
-        assert!(!agent_realtime_active(false, 500, 500, false, false));
-        assert!(agent_realtime_active(false, 0, 500, true, false));
-        assert!(agent_realtime_active(false, 0, 500, false, true));
-        assert!(!agent_realtime_active(true, 700, 500, true, true));
-    }
-
-    #[test]
-    fn d1_flush_guard_is_exclusive_and_releases_on_drop() {
-        let active = RefCell::new(HashSet::new());
-        let guard = ActiveD1FlushGuard::acquire(&active, "node-a").expect("first flush lock");
-        assert!(ActiveD1FlushGuard::acquire(&active, "node-a").is_none());
-        assert!(ActiveD1FlushGuard::acquire(&active, "node-b").is_some());
-        drop(guard);
-        assert!(ActiveD1FlushGuard::acquire(&active, "node-a").is_some());
-    }
-
-    #[test]
-    fn bounds_agent_messages_per_connection_window() {
-        let mut budget = AgentMessageBudget::default();
-        assert!(consume_agent_message_budget(
-            &mut budget,
-            100,
-            MAX_AGENT_BYTES_PER_WINDOW as usize,
-            MAX_AGENT_SAMPLES_PER_WINDOW as usize,
-        ));
-        assert!(!consume_agent_message_budget(&mut budget, 100, 1, 0));
-
-        let mut message_budget = AgentMessageBudget::default();
-        for _ in 0..MAX_AGENT_MESSAGES_PER_WINDOW {
-            assert!(consume_agent_message_budget(&mut message_budget, 100, 1, 1));
-        }
-        assert!(!consume_agent_message_budget(
-            &mut message_budget,
-            100,
-            1,
-            1
-        ));
-        assert!(consume_agent_message_budget(&mut message_budget, 160, 1, 1));
-    }
-
-    #[test]
-    fn live_payload_contains_cycle_adjusted_traffic_and_latency() {
-        let report = AgentReport {
-            timestamp: 1_234,
-            cpu: 12.5,
-            load1: 0.5,
-            load5: 0.4,
-            load15: 0.3,
-            mem_used: 1,
-            mem_total: 2,
-            swap_used: 0,
-            swap_total: 0,
-            disk_used: 3,
-            disk_total: 4,
-            net_in: 100.0,
-            net_out: 200.0,
-            net_rx_total: 300,
-            net_tx_total: 400,
-            uptime: 500,
-            processes: 10,
-            tcp_connections: 2,
-            udp_connections: 1,
-            cpu_cores: 2,
-            cpu_model: "CPU".to_string(),
-            os: "Linux".to_string(),
-            kernel: "6.0".to_string(),
-            arch: "x86_64".to_string(),
-            virtualization: "kvm".to_string(),
-            gpu_usage: 0.0,
-            gpu_model: String::new(),
-            agent_version: "test".to_string(),
-            ip_v4: "203.0.113.7".to_string(),
-            ip_v6: String::new(),
-            disk_read_bps: 0.0,
-            disk_write_bps: 0.0,
-            disk_read_iops: 0.0,
-            disk_write_iops: 0.0,
-            disk_await_ms: 0.0,
-            disk_utilization: 0.0,
-            disks: vec![],
-            gpus: vec![],
-            latency_results: vec![],
-        };
-        let mut traffic = TrafficAttachment {
-            reset_day: 1,
-            state_reset_day: 1,
-            timestamp: 1_230,
-            cycle_key: crate::db::traffic_cycle_key(1_234, 1),
-            raw_rx: 100,
-            raw_tx: 100,
-            used_rx: 500,
-            used_tx: 700,
-            rx_correction: 10,
-            tx_correction: 20,
-        };
-        let payload =
-            batch_update_parts_at("node-a", std::slice::from_ref(&report), &mut traffic, 1_235)
-                .unwrap()
-                .0;
-        let payload: serde_json::Value = serde_json::from_str(&payload).unwrap();
-        assert_eq!(payload["type"], "batchUpdate");
-        assert_eq!(payload["updates"][0]["serverId"], "node-a");
-        assert_eq!(payload["updates"][0]["samples"][0]["ts"], 1_234);
-        assert_eq!(payload["updates"][0]["samples"][0]["data"]["cpu"], 12.5);
-        assert_eq!(
-            payload["updates"][0]["samples"][0]["data"]["net_rx_total"],
-            710
-        );
-        assert!(payload["updates"][0]["samples"][0]["data"]
-            .get("timestamp")
-            .is_none());
-        // 身份字段不上线：前端靠 bootstrap 那份。fixture 里 cpu_model="CPU"、
-        // agent_version="test" 都是非空的，所以这几条断言不是空转。
-        for field in BROWSER_OMITTED_REPORT_FIELDS {
-            assert!(
-                payload["updates"][0]["samples"][0]["data"]
-                    .get(field)
-                    .is_none(),
-                "{field} 不应出现在发往浏览器的样本里"
-            );
-        }
-        // 同一批的动态字段必须留着，别把剥离范围扩大了
-        for field in [
-            "cpu",
-            "mem_used",
-            "net_in",
-            "uptime",
-            "cpu_cores",
-            "gpu_usage",
-        ] {
-            assert!(
-                payload["updates"][0]["samples"][0]["data"]
-                    .get(field)
-                    .is_some(),
-                "{field} 是动态字段，不该被剥离"
-            );
-        }
-        let attachment = SocketAttachment {
-            role: "agent".to_string(),
-            server_id: Some("node-a".to_string()),
-            hidden: false,
-            report_interval: 60,
-            collect_interval: 1,
-            last_d1_write_at: 1_200,
-            persisted_through: 1_190,
-            d1_flush: None,
-            traffic: None,
-            history_aggregate: HistoryMetricAggregate::default(),
-            latency_aggregates: LatencyMetricAggregates::default(),
-            latest_samples: Vec::new(),
-            latest_received_at: 0,
-            message_budget: AgentMessageBudget::default(),
-            dashboard_present_until: 0,
-        };
-        assert_eq!(agent_wss_interval_ms(&attachment, true), 4_000);
-        assert_eq!(agent_wss_interval_ms(&attachment, false), 60_000);
-        // 1_200 + 60s 落库间隔 - now 1_235 = 25s。
-        assert_eq!(next_d1_write_ms(&attachment, 1_235), 25_000);
-        let hint: serde_json::Value = serde_json::from_str(
-            &live_ack_payload(1_235, false, false, 1_190, 25_000, 4_000, true).unwrap(),
-        )
-        .unwrap();
-        assert_eq!(hint["realtimeHint"], true);
-        assert_eq!(hint["persistedThroughTs"], 1_190);
-        assert_eq!(hint["nextWssReportAfterMs"], 4_000);
-
-        let mut corrected_down = traffic;
-        corrected_down.rx_correction = -800;
-        let mut corrected_report = report.clone();
-        corrected_report.timestamp = 1_235;
-        corrected_report.net_rx_total = 301;
-        let payload =
-            batch_update_parts_at("node-a", &[corrected_report], &mut corrected_down, 1_236)
-                .unwrap()
-                .0;
-        let payload: serde_json::Value = serde_json::from_str(&payload).unwrap();
-        assert_eq!(
-            payload["updates"][0]["samples"][0]["data"]["net_rx_total"],
-            0
-        );
-    }
-
-    #[test]
-    fn bounds_and_expires_cached_live_samples() {
-        let mut samples = (0..(MAX_CACHED_LIVE_SAMPLES + 8))
-            .map(|index| CachedLiveSample {
-                ts: index as i64,
-                data: serde_json::json!({ "cpu": index }),
-            })
-            .collect::<Vec<_>>();
-        trim_cached_live_samples(&mut samples);
-        assert_eq!(samples.len(), MAX_CACHED_LIVE_SAMPLES);
-        assert_eq!(samples[0].ts, 8);
-
-        let mut attachment = SocketAttachment {
-            role: "agent".to_string(),
-            server_id: Some("node-a".to_string()),
-            hidden: false,
-            report_interval: 60,
-            collect_interval: 1,
-            last_d1_write_at: 0,
-            persisted_through: 0,
-            d1_flush: None,
-            traffic: None,
-            history_aggregate: HistoryMetricAggregate::default(),
-            latency_aggregates: LatencyMetricAggregates::default(),
-            latest_samples: samples,
-            latest_received_at: 100,
-            message_budget: AgentMessageBudget::default(),
-            dashboard_present_until: 0,
-        };
-        let update = cached_update_value(&attachment, 102, Some("node-a")).unwrap();
-        assert_eq!(update["serverId"], "node-a");
-        assert_eq!(update["reportAgeMs"], 2_000);
-        assert_eq!(
-            update["samples"].as_array().unwrap().len(),
-            MAX_CACHED_LIVE_SAMPLES
-        );
-        assert!(cached_update_value(&attachment, 102, Some("node-b")).is_none());
-        assert!(cached_update_value(&attachment, 101 + CACHED_LIVE_TTL_SECONDS, None).is_none());
-
-        let mut oversized = vec![CachedLiveSample {
-            ts: 1,
-            data: serde_json::json!({ "value": "x".repeat(MAX_CACHED_LIVE_BYTES) }),
-        }];
-        trim_cached_live_samples(&mut oversized);
-        assert!(oversized.is_empty());
-
-        let latency_results = (0..128)
-            .map(|index| AgentLatencyResult {
-                task_id: format!("00000000-0000-0000-0000-{index:012}"),
-                timestamp: 100,
-                latency_ms: index as f64,
-                packet_loss: 0.0,
-            })
-            .collect::<Vec<_>>();
-        attachment.latency_aggregates.extend(&latency_results, 100);
-        assert!(trim_socket_attachment(&mut attachment));
-        assert!(serde_json::to_vec(&attachment).unwrap().len() <= MAX_SERIALIZED_ATTACHMENT_BYTES);
-    }
-
-    #[test]
-    fn keeps_samples_received_during_d1_flush_for_next_write() {
-        let first = AgentReport {
-            timestamp: 120,
-            cpu: 10.0,
-            net_in: 100.0,
-            latency_results: vec![AgentLatencyResult {
-                task_id: "task-a".to_string(),
-                timestamp: 120,
-                latency_ms: 10.0,
-                packet_loss: 0.0,
-            }],
-            ..AgentReport::default()
-        };
-        let second = AgentReport {
-            timestamp: 121,
-            cpu: 20.0,
-            net_in: 500.0,
-            latency_results: vec![AgentLatencyResult {
-                task_id: "task-a".to_string(),
-                timestamp: 121,
-                latency_ms: 20.0,
-                packet_loss: 10.0,
-            }],
-            ..AgentReport::default()
-        };
-        let mut attachment = SocketAttachment {
-            role: "agent".to_string(),
-            server_id: Some("node-a".to_string()),
-            hidden: false,
-            report_interval: 60,
-            collect_interval: 1,
-            last_d1_write_at: 60,
-            persisted_through: 60,
-            d1_flush: None,
-            traffic: None,
-            history_aggregate: HistoryMetricAggregate::default(),
-            latency_aggregates: LatencyMetricAggregates::default(),
-            latest_samples: Vec::new(),
-            latest_received_at: 0,
-            message_budget: AgentMessageBudget::default(),
-            dashboard_present_until: 0,
-        };
-        attachment
-            .history_aggregate
-            .extend(std::slice::from_ref(&first));
-        attachment
-            .latency_aggregates
-            .extend(&first.latency_results, first.timestamp);
-
-        let mut successful = attachment.clone();
-        let successful_snapshot = begin_d1_flush(&mut successful).unwrap();
-        assert!(successful.d1_flush.is_some());
-        assert!(successful.history_aggregate.point().is_none());
-        assert!(begin_d1_flush(&mut successful).is_some());
-        let serialized = serde_json::to_vec(&successful).unwrap();
-        successful = serde_json::from_slice(&serialized).unwrap();
-        assert_eq!(
-            begin_d1_flush(&mut successful)
-                .unwrap()
-                .history
-                .point()
-                .unwrap()
-                .cpu,
-            10.0
-        );
-        successful
-            .history_aggregate
-            .extend(std::slice::from_ref(&second));
-        successful
-            .latency_aggregates
-            .extend(&second.latency_results, second.timestamp);
-        assert_eq!(successful_snapshot.history.point().unwrap().cpu, 10.0);
-        finish_d1_flush(&mut successful, true, 180, 120);
-
-        let pending = successful.history_aggregate.point().unwrap();
-        assert_eq!(pending.cpu, 20.0);
-        assert_eq!(pending.net_in, 500.0);
-        assert_eq!(successful.last_d1_write_at, 180);
-        assert_eq!(successful.persisted_through, 120);
-        assert!(successful.d1_flush.is_none());
-        let latency = serde_json::to_value(&successful.latency_aggregates).unwrap();
-        assert_eq!(latency["v"]["task-a"][0].as_u64(), Some(1));
-        assert_eq!(latency["v"]["task-a"][4].as_i64(), Some(121));
-
-        let failed_snapshot = begin_d1_flush(&mut attachment).unwrap();
-        attachment
-            .history_aggregate
-            .extend(std::slice::from_ref(&second));
-        attachment
-            .latency_aggregates
-            .extend(&second.latency_results, second.timestamp);
-        assert_eq!(failed_snapshot.history.point().unwrap().cpu, 10.0);
-        finish_d1_flush(&mut attachment, false, 180, 120);
-
-        let retried = attachment.history_aggregate.point().unwrap();
-        assert_eq!(retried.cpu, 15.0);
-        assert_eq!(retried.net_in, 500.0);
-        assert_eq!(attachment.last_d1_write_at, 60);
-        assert_eq!(attachment.persisted_through, 60);
-        assert!(attachment.d1_flush.is_none());
-        let latency = serde_json::to_value(&attachment.latency_aggregates).unwrap();
-        assert_eq!(latency["v"]["task-a"][0].as_u64(), Some(2));
-        assert_eq!(latency["v"]["task-a"][4].as_i64(), Some(121));
-    }
-
-    #[test]
-    fn merges_and_evaluates_persistent_alert_windows() {
-        let mut samples = Vec::<AlertWindowSample>::new();
-        update_alert_window(&mut samples, &alert_point(121, 10.0, 1_048_576.0));
-        update_alert_window(&mut samples, &alert_point(149, 30.0, 3_145_728.0));
-        update_alert_window(&mut samples, &alert_point(181, 40.0, 2_097_152.0));
-        assert_eq!(samples.len(), 2);
-        assert_eq!(samples[0].metric("cpu"), Some(20.0));
-        assert_eq!(samples[0].metric("memory"), Some(50.0));
-        assert_eq!(samples[0].metric("disk"), Some(25.0));
-        assert_eq!(samples[0].metric("net_in"), Some(3.0));
-
-        let server = AlertEvaluationServer {
-            id: "node-a".to_string(),
-            name: "Node A".to_string(),
-            report_interval: 60,
-        };
-        let mut rule = AlertRuleView {
-            id: "rule-a".to_string(),
-            name: "CPU".to_string(),
-            metric: "cpu".to_string(),
-            threshold: 25.0,
-            duration_minutes: 2,
-            aggregation: "average".to_string(),
-            enabled: true,
-            server_ids: Vec::new(),
-        };
-        let average = super::evaluate_alert_window(&samples, &rule, &server, 240).unwrap();
-        assert_eq!(average.value, 30.0);
-        assert_eq!(average.sample_count, 2);
-        assert_eq!(average.first_timestamp, 120);
-        assert_eq!(average.last_timestamp, 180);
-
-        rule.aggregation = "continuous".to_string();
-        let continuous = super::evaluate_alert_window(&samples, &rule, &server, 240).unwrap();
-        assert_eq!(continuous.value, 20.0);
-
-        for minute in 0..1_500 {
-            update_alert_window(&mut samples, &alert_point(minute * 60, minute as f64, 0.0));
-        }
-        assert!(samples.len() <= super::MAX_ALERT_WINDOW_SAMPLES);
-        assert!(samples.last().unwrap().0 - samples.first().unwrap().0 <= ALERT_WINDOW_SECONDS);
-    }
-}
diff --git a/src/notify.rs b/src/notify.rs
deleted file mode 100644
index f9e3cf4..0000000
--- a/src/notify.rs
+++ /dev/null
@@ -1,894 +0,0 @@
-use std::collections::{HashMap, HashSet};
-use std::time::Duration;
-
-use serde::{Deserialize, Serialize};
-use serde_json::{json, Value};
-use worker::{
-    console_warn, wasm_bindgen::JsValue, D1Database, Headers, Method, Request, RequestInit, Result,
-};
-
-use crate::auth::sha256_hex;
-use crate::db::{self, SettingsView, SECRET_MASK};
-use crate::live;
-use crate::models::TelegramNotificationInput;
-use crate::outbound::{fetch_with_timeout, read_response_limited};
-
-const NOTIFICATION_TIMEOUT: Duration = Duration::from_secs(8);
-const NOTIFICATION_MAX_BYTES: usize = 64 * 1024;
-const MAX_DELIVERY_ATTEMPTS: i64 = 6;
-const DELIVERY_BATCH_SIZE: i64 = 5;
-const TEMPLATE_KEYS: [&str; 7] = [
-    "event",
-    "title",
-    "server",
-    "message",
-    "time",
-    "value",
-    "threshold",
-];
-
-#[derive(Clone, Default, Deserialize, Serialize, PartialEq, Eq)]
-struct AlertState {
-    offline: HashSet<String>,
-    expiry: HashSet<String>,
-    resources: HashSet<String>,
-    traffic: HashMap<String, TrafficAlertState>,
-}
-
-#[derive(Clone, Default, Deserialize, Serialize, PartialEq, Eq)]
-struct TrafficAlertState {
-    cycle_key: i64,
-    step: i64,
-}
-
-#[derive(Clone, Deserialize)]
-struct TelegramSettingsRow {
-    bot_token: String,
-    chat_id: String,
-    message_thread_id: Option<i64>,
-    template: String,
-}
-
-#[derive(Serialize)]
-pub struct TelegramSettingsView {
-    bot_token: String,
-    chat_id: String,
-    message_thread_id: Option<i64>,
-    template: String,
-}
-
-#[derive(Debug, Deserialize, Serialize)]
-#[serde(deny_unknown_fields)]
-struct TelegramConfig {
-    bot_token: String,
-    chat_id: String,
-    #[serde(default)]
-    message_thread_id: Option<i64>,
-}
-
-#[derive(Serialize)]
-struct NewEvent {
-    id: String,
-    dedupe_key: String,
-    kind: String,
-    server_id: Option<String>,
-    server_name: String,
-    title: String,
-    message: String,
-    details: Value,
-    occurred_at: i64,
-}
-
-struct EventSource<'a> {
-    server_id: Option<&'a str>,
-    server_name: &'a str,
-}
-
-#[derive(Deserialize)]
-struct PendingDeliveryRow {
-    event_id: String,
-    attempts: i64,
-    kind: String,
-    server_name: String,
-    title: String,
-    message: String,
-    details_json: String,
-    occurred_at: i64,
-    bot_token: String,
-    chat_id: String,
-    message_thread_id: Option<i64>,
-    template: String,
-}
-
-fn text(value: &str) -> JsValue {
-    JsValue::from_str(value)
-}
-
-fn number(value: impl ToString) -> JsValue {
-    JsValue::from_f64(value.to_string().parse::<f64>().unwrap_or(0.0))
-}
-
-fn event(
-    dedupe_key: String,
-    kind: &str,
-    source: EventSource<'_>,
-    title: String,
-    message: String,
-    details: Value,
-    occurred_at: i64,
-) -> NewEvent {
-    NewEvent {
-        id: sha256_hex(&dedupe_key).chars().take(32).collect(),
-        dedupe_key,
-        kind: kind.to_string(),
-        server_id: source.server_id.map(str::to_string),
-        server_name: source.server_name.to_string(),
-        title,
-        message,
-        details,
-        occurred_at,
-    }
-}
-
-fn valid_telegram_token(value: &str) -> bool {
-    let value = value.trim();
-    value.split_once(':').is_some_and(|(bot_id, secret)| {
-        !bot_id.is_empty()
-            && bot_id.chars().all(|ch| ch.is_ascii_digit())
-            && secret.len() >= 20
-            && secret
-                .chars()
-                .all(|ch| ch.is_ascii_alphanumeric() || matches!(ch, '_' | '-'))
-    })
-}
-
-fn validate_template(template: &str) -> Option<String> {
-    if template.trim().is_empty() || template.chars().count() > 4000 {
-        return Some("通知模板长度应为 1 至 4000 个字符".to_string());
-    }
-    let mut rest = template;
-    while let Some(start) = rest.find("{{") {
-        if rest[..start].contains("}}") {
-            return Some("通知模板占位符格式无效".to_string());
-        }
-        let after = &rest[start + 2..];
-        let Some(end) = after.find("}}") else {
-            return Some("通知模板占位符未闭合".to_string());
-        };
-        let placeholder = &after[..end];
-        let key = placeholder.trim();
-        if placeholder != key || !TEMPLATE_KEYS.contains(&key) {
-            return Some(format!("通知模板包含不支持的占位符：{{{{{key}}}}}"));
-        }
-        rest = &after[end + 2..];
-    }
-    if rest.contains("}}") {
-        return Some("通知模板占位符格式无效".to_string());
-    }
-    None
-}
-
-fn normalized_telegram(
-    input: &TelegramNotificationInput,
-    previous: Option<&TelegramSettingsRow>,
-) -> std::result::Result<TelegramConfig, String> {
-    if let Some(message) = validate_template(&input.template) {
-        return Err(message);
-    }
-    let bot_token = if input.bot_token.trim() == SECRET_MASK {
-        let Some(previous) = previous else {
-            return Err("Telegram Bot Token 不能为空".to_string());
-        };
-        previous.bot_token.clone()
-    } else {
-        input.bot_token.trim().to_string()
-    };
-    let chat_id = input.chat_id.trim().to_string();
-    if !valid_telegram_token(&bot_token)
-        || chat_id.is_empty()
-        || chat_id.chars().count() > 128
-        || input.message_thread_id.is_some_and(|value| value <= 0)
-    {
-        return Err("Telegram Bot Token、Chat ID 或话题 ID 格式无效".to_string());
-    }
-    Ok(TelegramConfig {
-        bot_token,
-        chat_id,
-        message_thread_id: input.message_thread_id,
-    })
-}
-
-async fn telegram_row(db_conn: &D1Database) -> Result<Option<TelegramSettingsRow>> {
-    db_conn
-        .prepare(
-            "SELECT bot_token, chat_id, message_thread_id, template \
-             FROM notification_telegram WHERE id=1",
-        )
-        .first(None)
-        .await
-}
-
-pub async fn telegram_settings(db_conn: &D1Database) -> Result<Option<TelegramSettingsView>> {
-    Ok(telegram_row(db_conn)
-        .await?
-        .map(|row| TelegramSettingsView {
-            bot_token: SECRET_MASK.to_string(),
-            chat_id: row.chat_id,
-            message_thread_id: row.message_thread_id,
-            template: row.template,
-        }))
-}
-
-pub async fn save_telegram(
-    db_conn: &D1Database,
-    input: &TelegramNotificationInput,
-    timestamp: i64,
-) -> Result<std::result::Result<(), String>> {
-    let previous = telegram_row(db_conn).await?;
-    let config = match normalized_telegram(input, previous.as_ref()) {
-        Ok(value) => value,
-        Err(message) => return Ok(Err(message)),
-    };
-    db_conn
-        .prepare(
-            "INSERT INTO notification_telegram( \
-               id, bot_token, chat_id, message_thread_id, template, updated_at \
-             ) VALUES (1, ?1, ?2, ?3, ?4, ?5) \
-             ON CONFLICT(id) DO UPDATE SET bot_token=excluded.bot_token, chat_id=excluded.chat_id, \
-               message_thread_id=excluded.message_thread_id, template=excluded.template, \
-               updated_at=excluded.updated_at",
-        )
-        .bind(&[
-            text(&config.bot_token),
-            text(&config.chat_id),
-            config
-                .message_thread_id
-                .map(number)
-                .unwrap_or(JsValue::NULL),
-            text(input.template.trim()),
-            number(timestamp),
-        ])?
-        .run()
-        .await?;
-    Ok(Ok(()))
-}
-
-fn value_text(value: &Value) -> String {
-    value
-        .as_str()
-        .map(str::to_string)
-        .unwrap_or_else(|| value.to_string())
-}
-
-fn template_values(
-    kind: &str,
-    title: &str,
-    server: &str,
-    message: &str,
-    time: &str,
-    details: &Value,
-) -> Vec<(&'static str, String)> {
-    vec![
-        ("event", kind.to_string()),
-        ("title", title.to_string()),
-        ("server", server.to_string()),
-        ("message", message.to_string()),
-        ("time", time.to_string()),
-        (
-            "value",
-            details.get("value").map(value_text).unwrap_or_default(),
-        ),
-        (
-            "threshold",
-            details.get("threshold").map(value_text).unwrap_or_default(),
-        ),
-    ]
-}
-
-fn render_template(template: &str, values: &[(&str, String)]) -> String {
-    let mut output = String::with_capacity(template.len());
-    let mut rest = template;
-    while let Some(start) = rest.find("{{") {
-        output.push_str(&rest[..start]);
-        let after = &rest[start + 2..];
-        let Some(end) = after.find("}}") else {
-            output.push_str(&rest[start..]);
-            return output;
-        };
-        let key = &after[..end];
-        if let Some((_, value)) = values.iter().find(|(candidate, _)| *candidate == key) {
-            output.push_str(value);
-        } else {
-            output.push_str(&rest[start..start + end + 4]);
-        }
-        rest = &after[end + 2..];
-    }
-    output.push_str(rest);
-    output
-}
-
-fn iso_time(timestamp: i64) -> String {
-    let value = worker::js_sys::Date::new(&JsValue::from_f64(timestamp as f64 * 1000.0));
-    value
-        .to_iso_string()
-        .as_string()
-        .unwrap_or_else(|| timestamp.to_string())
-}
-
-async fn send_request(url: &str, headers: Headers, body: &str) -> Result<()> {
-    let mut init = RequestInit::new();
-    init.with_method(Method::Post)
-        .with_headers(headers)
-        .with_body(Some(JsValue::from_str(body)));
-    let request = Request::new_with_init(url, &init)
-        .map_err(|_| worker::Error::RustError("通知服务请求无效".to_string()))?;
-    let Some(mut response) = fetch_with_timeout(request, NOTIFICATION_TIMEOUT)
-        .await
-        .map_err(|_| worker::Error::RustError("通知服务请求失败".to_string()))?
-    else {
-        return Err(worker::Error::RustError("通知服务请求超时".to_string()));
-    };
-    let status = response.status_code();
-    read_response_limited(&mut response, NOTIFICATION_MAX_BYTES)
-        .await?
-        .ok_or_else(|| worker::Error::RustError("通知服务响应体大小无效".to_string()))?;
-    if !(200..300).contains(&status) {
-        return Err(worker::Error::RustError(format!(
-            "通知服务返回 HTTP {status}"
-        )));
-    }
-    Ok(())
-}
-
-async fn send_delivery(row: &PendingDeliveryRow) -> Result<()> {
-    let details = serde_json::from_str::<Value>(&row.details_json).unwrap_or_else(|_| json!({}));
-    let occurred_at = iso_time(row.occurred_at);
-    let values = template_values(
-        &row.kind,
-        &row.title,
-        &row.server_name,
-        &row.message,
-        &occurred_at,
-        &details,
-    );
-    let rendered_message = render_template(&row.template, &values);
-    let headers = Headers::new();
-    headers.set("Content-Type", "application/json")?;
-    let mut body = json!({ "chat_id": row.chat_id, "text": rendered_message });
-    if let Some(message_thread_id) = row.message_thread_id {
-        body["message_thread_id"] = json!(message_thread_id);
-    }
-    send_request(
-        &format!("https://api.telegram.org/bot{}/sendMessage", row.bot_token),
-        headers,
-        &body.to_string(),
-    )
-    .await
-}
-
-fn retry_delay(attempts: i64) -> i64 {
-    match attempts {
-        0 | 1 => 60,
-        2 => 300,
-        3 => 900,
-        _ => 3600,
-    }
-}
-
-async fn attempt_delivery(
-    db_conn: &D1Database,
-    row: &PendingDeliveryRow,
-    timestamp: i64,
-) -> Result<Option<String>> {
-    let attempts = row.attempts + 1;
-    match send_delivery(row).await {
-        Ok(()) => {
-            db_conn
-                .prepare(
-                    "UPDATE notification_deliveries SET status='sent', attempts=?2, sent_at=?3, \
-                     last_error=NULL, updated_at=?3 WHERE event_id=?1",
-                )
-                .bind(&[text(&row.event_id), number(attempts), number(timestamp)])?
-                .run()
-                .await?;
-            Ok(None)
-        }
-        Err(error) => {
-            let message = error.to_string().chars().take(300).collect::<String>();
-            let status = if attempts >= MAX_DELIVERY_ATTEMPTS {
-                "dead"
-            } else {
-                "failed"
-            };
-            db_conn
-                .prepare(
-                    "UPDATE notification_deliveries SET status=?2, attempts=?3, next_attempt_at=?4, \
-                     last_error=?5, updated_at=?6 WHERE event_id=?1",
-                )
-                .bind(&[
-                    text(&row.event_id),
-                    text(status),
-                    number(attempts),
-                    number(timestamp.saturating_add(retry_delay(attempts))),
-                    text(&message),
-                    number(timestamp),
-                ])?
-                .run()
-                .await?;
-            Ok(Some(message))
-        }
-    }
-}
-
-const DELIVERY_SELECT: &str =
-    "SELECT d.event_id, d.attempts, e.kind, e.server_name, e.title, e.message, \
-            e.details_json, e.occurred_at, t.bot_token, t.chat_id, t.message_thread_id, t.template \
-     FROM notification_deliveries d \
-     JOIN notification_events e ON e.id=d.event_id \
-     JOIN notification_telegram t ON t.id=1";
-
-pub async fn process_pending(db_conn: &D1Database, timestamp: i64) -> Result<usize> {
-    let rows: Vec<PendingDeliveryRow> = db_conn
-        .prepare(format!(
-            "{DELIVERY_SELECT} WHERE d.status IN ('pending', 'failed') AND d.next_attempt_at<=?1 \
-             ORDER BY d.created_at ASC LIMIT ?2"
-        ))
-        .bind(&[number(timestamp), number(DELIVERY_BATCH_SIZE)])?
-        .all()
-        .await?
-        .results()?;
-    let count = rows.len();
-    for row in rows {
-        if let Some(message) = attempt_delivery(db_conn, &row, timestamp).await? {
-            console_warn!("telegram notification delivery failed: {message}");
-        }
-    }
-    Ok(count)
-}
-
-pub async fn test_telegram(
-    db_conn: &D1Database,
-    test_id: &str,
-    timestamp: i64,
-) -> Result<std::result::Result<(), String>> {
-    if telegram_row(db_conn).await?.is_none() {
-        return Ok(Err("尚未保存 Telegram 配置".to_string()));
-    };
-    let test_event = event(
-        format!("test:telegram:{test_id}"),
-        "test",
-        EventSource {
-            server_id: None,
-            server_name: "NodeFlare",
-        },
-        "NodeFlare 测试通知".to_string(),
-        "Telegram 配置成功，事件投递链路工作正常。".to_string(),
-        json!({}),
-        timestamp,
-    );
-    let event_insert = db_conn
-        .prepare(
-            "INSERT INTO notification_events( \
-               id, dedupe_key, kind, server_id, server_name, title, message, details_json, occurred_at, created_at \
-             ) VALUES (?1, ?2, 'test', NULL, ?3, ?4, ?5, '{}', ?6, ?6)",
-        )
-        .bind(&[
-            text(&test_event.id),
-            text(&test_event.dedupe_key),
-            text(&test_event.server_name),
-            text(&test_event.title),
-            text(&test_event.message),
-            number(timestamp),
-        ])?;
-    let delivery_insert = db_conn
-        .prepare(
-            "INSERT INTO notification_deliveries( \
-               event_id, status, attempts, next_attempt_at, created_at, updated_at \
-             ) VALUES (?1, 'pending', 0, ?2, ?2, ?2)",
-        )
-        .bind(&[text(&test_event.id), number(timestamp)])?;
-    db_conn.batch(vec![event_insert, delivery_insert]).await?;
-    let row = db_conn
-        .prepare(format!("{DELIVERY_SELECT} WHERE d.event_id=?1"))
-        .bind(&[text(&test_event.id)])?
-        .first::<PendingDeliveryRow>(None)
-        .await?
-        .ok_or_else(|| worker::Error::RustError("测试投递记录创建失败".to_string()))?;
-    match attempt_delivery(db_conn, &row, timestamp).await? {
-        Some(message) => Ok(Err(message)),
-        None => Ok(Ok(())),
-    }
-}
-
-async fn has_telegram(db_conn: &D1Database) -> Result<bool> {
-    Ok(db_conn
-        .prepare("SELECT 1 AS found FROM notification_telegram WHERE id=1")
-        .first::<i64>(Some("found"))
-        .await?
-        .is_some())
-}
-
-async fn notification_state(db_conn: &D1Database) -> Result<AlertState> {
-    let raw = db_conn
-        .prepare("SELECT value FROM notification_state WHERE id=1")
-        .first::<String>(Some("value"))
-        .await?
-        .unwrap_or_else(|| "{}".to_string());
-    Ok(serde_json::from_str(&raw).unwrap_or_default())
-}
-
-async fn persist_events_and_state(
-    db_conn: &D1Database,
-    events: &[NewEvent],
-    state: &AlertState,
-    timestamp: i64,
-) -> Result<()> {
-    let state_json = serde_json::to_string(state)?;
-    let state_update = db_conn
-        .prepare("UPDATE notification_state SET value=?1, updated_at=?2 WHERE id=1")
-        .bind(&[text(&state_json), number(timestamp)])?;
-    if events.is_empty() {
-        state_update.run().await?;
-        return Ok(());
-    }
-    let events_json = serde_json::to_string(events)?;
-    let event_insert = db_conn
-        .prepare(
-            "INSERT OR IGNORE INTO notification_events( \
-               id, dedupe_key, kind, server_id, server_name, title, message, details_json, occurred_at, created_at \
-             ) SELECT json_extract(value, '$.id'), json_extract(value, '$.dedupe_key'), \
-                    json_extract(value, '$.kind'), json_extract(value, '$.server_id'), \
-                    json_extract(value, '$.server_name'), json_extract(value, '$.title'), \
-                    json_extract(value, '$.message'), json_extract(value, '$.details'), \
-                    json_extract(value, '$.occurred_at'), ?2 FROM json_each(?1)",
-        )
-        .bind(&[text(&events_json), number(timestamp)])?;
-    let delivery_insert = db_conn
-        .prepare(
-            "INSERT OR IGNORE INTO notification_deliveries( \
-               event_id, status, attempts, next_attempt_at, created_at, updated_at \
-             ) SELECT e.id, 'pending', 0, ?2, ?2, ?2 \
-             FROM json_each(?1) j JOIN notification_events e ON e.id=json_extract(j.value, '$.id') \
-             WHERE EXISTS (SELECT 1 FROM notification_telegram WHERE id=1)",
-        )
-        .bind(&[text(&events_json), number(timestamp)])?;
-    db_conn
-        .batch(vec![event_insert, delivery_insert, state_update])
-        .await?;
-    Ok(())
-}
-
-fn traffic_used(server: &crate::models::ServerView) -> Option<i64> {
-    let rx = server.net_rx_total?;
-    let tx = server.net_tx_total?;
-    Some(match server.traffic_limit_type.as_str() {
-        "max" => rx.max(tx),
-        "min" => rx.min(tx),
-        "up" => tx,
-        "down" => rx,
-        _ => rx.saturating_add(tx),
-    })
-}
-
-fn traffic_step(used: i64, limit: i64, threshold: i64) -> i64 {
-    if limit <= 0 {
-        return 0;
-    }
-    let percent = ((i128::from(used.max(0)) * 100) / i128::from(limit)).min(100) as i64;
-    if percent < threshold {
-        0
-    } else {
-        threshold + ((percent - threshold) / 5) * 5
-    }
-}
-
-fn gibibytes(value: i64) -> String {
-    format!("{:.2} GiB", value.max(0) as f64 / 1024_f64.powi(3))
-}
-
-pub async fn renew_servers(db_conn: &D1Database) -> Result<()> {
-    let current_time = crate::now();
-    for server in db::list_servers(db_conn, true).await? {
-        if server.auto_renewal == 0 {
-            continue;
-        }
-        let Some(expires_at) = server.expires_at else {
-            continue;
-        };
-        if let Some(next_expiry) = renewed_expiry(expires_at, server.billing_cycle, current_time) {
-            db::update_expiry(db_conn, &server.id, next_expiry).await?;
-        }
-    }
-    Ok(())
-}
-
-fn renewed_expiry(expires_at: i64, billing_cycle_days: i64, current_time: i64) -> Option<i64> {
-    // billing_cycle = 0 是「一次性」，没有周期可续。不拦的话下面的 clamp(1, ..)
-    // 会把它当成 1 天，每跑一次 cron 就把到期日推一天，节点永远停在「剩 1 天」。
-    if billing_cycle_days <= 0 {
-        return None;
-    }
-    let renew_before = i128::from(current_time) + 86_400;
-    let expires_at = i128::from(expires_at);
-    if expires_at > renew_before {
-        return None;
-    }
-    let cycle = i128::from(billing_cycle_days.clamp(1, 3650)) * 86_400;
-    let elapsed = renew_before - expires_at;
-    let cycles = elapsed / cycle + 1;
-    Some((expires_at + cycles * cycle).min(i128::from(i64::MAX)) as i64)
-}
-
-pub async fn check_alerts(
-    db_conn: &D1Database,
-    env: &worker::Env,
-    settings: &SettingsView,
-) -> Result<()> {
-    if !settings.notification_enabled || !has_telegram(db_conn).await? {
-        return Ok(());
-    }
-    let servers = db::list_servers(db_conn, true).await?;
-    let previous = notification_state(db_conn).await?;
-    let mut current = AlertState::default();
-    let current_time = crate::now();
-    let offline_after = settings.offline_alert_minutes.clamp(2, 1440) * 60;
-    let mut events = Vec::new();
-
-    for server in &servers {
-        let source_timestamp = server.timestamp.unwrap_or(server.created_at);
-        let is_offline = current_time.saturating_sub(source_timestamp) > offline_after;
-        if server.offline_notify_disabled == 0 && is_offline {
-            current.offline.insert(server.id.clone());
-            if !previous.offline.contains(&server.id) {
-                events.push(event(
-                    format!("offline:{}:{source_timestamp}", server.id),
-                    "offline",
-                    EventSource {
-                        server_id: Some(&server.id),
-                        server_name: &server.name,
-                    },
-                    "服务器离线".to_string(),
-                    format!(
-                        "已超过 {} 分钟未收到状态上报。",
-                        settings.offline_alert_minutes
-                    ),
-                    json!({ "threshold": settings.offline_alert_minutes }),
-                    current_time,
-                ));
-            }
-        } else if previous.offline.contains(&server.id) {
-            events.push(event(
-                format!("online:{}:{source_timestamp}", server.id),
-                "online",
-                EventSource {
-                    server_id: Some(&server.id),
-                    server_name: &server.name,
-                },
-                "服务器恢复".to_string(),
-                "状态上报已恢复。".to_string(),
-                json!({}),
-                current_time,
-            ));
-        }
-        if settings.expiry_alert_days > 0 {
-            if let Some(expires_at) = server.expires_at {
-                let days = (expires_at - current_time + 86_399) / 86_400;
-                if days >= 0 && days <= settings.expiry_alert_days {
-                    let key = format!("{}:{expires_at}", server.id);
-                    current.expiry.insert(key.clone());
-                    if !previous.expiry.contains(&key) {
-                        events.push(event(
-                            format!("expiry:{key}"),
-                            "expiry",
-                            EventSource {
-                                server_id: Some(&server.id),
-                                server_name: &server.name,
-                            },
-                            "服务器即将到期".to_string(),
-                            format!("剩余 {days} 天到期。"),
-                            json!({ "value": days, "threshold": settings.expiry_alert_days }),
-                            current_time,
-                        ));
-                    }
-                }
-            }
-        }
-        if server.traffic_limit > 0 {
-            if let Some(used) = traffic_used(server) {
-                let cycle_key = db::traffic_cycle_key(current_time, server.reset_day);
-                let step = traffic_step(
-                    used,
-                    server.traffic_limit,
-                    settings.traffic_alert_percentage,
-                );
-                current
-                    .traffic
-                    .insert(server.id.clone(), TrafficAlertState { cycle_key, step });
-                let previous_traffic = previous.traffic.get(&server.id);
-                if step >= settings.traffic_alert_percentage
-                    && previous_traffic
-                        .is_none_or(|state| state.cycle_key != cycle_key || step > state.step)
-                {
-                    events.push(event(
-                        format!("traffic:{}:{cycle_key}:{step}", server.id),
-                        "traffic",
-                        EventSource {
-                            server_id: Some(&server.id),
-                            server_name: &server.name,
-                        },
-                        "流量限额提醒".to_string(),
-                        format!("本周期已使用 {} / {}（{}%）。", gibibytes(used), gibibytes(server.traffic_limit), step),
-                        json!({ "value": step, "threshold": settings.traffic_alert_percentage, "used_bytes": used, "limit_bytes": server.traffic_limit }),
-                        current_time,
-                    ));
-                }
-            }
-        }
-    }
-
-    let mut evaluated_resources = HashSet::new();
-    let mut eligible_resources = HashSet::new();
-    let rules = db::list_alert_rules(db_conn).await?;
-    let mut values_by_rule = HashMap::new();
-    if rules.iter().any(|rule| rule.enabled) {
-        match live::evaluate_resource_alerts(env, &rules, &servers, current_time).await {
-            Ok(values) => {
-                for value in values {
-                    values_by_rule
-                        .entry(value.rule_id)
-                        .or_insert_with(Vec::new)
-                        .push(value.row);
-                }
-            }
-            Err(error) => console_warn!("resource alert evaluation failed: {error:?}"),
-        }
-    }
-    for rule in rules {
-        if !rule.enabled {
-            continue;
-        }
-        if rule.server_ids.is_empty() {
-            eligible_resources.extend(
-                servers
-                    .iter()
-                    .filter(|server| server.hidden == 0)
-                    .map(|server| format!("{}:{}", rule.id, server.id)),
-            );
-        } else {
-            eligible_resources.extend(
-                rule.server_ids
-                    .iter()
-                    .map(|server_id| format!("{}:{server_id}", rule.id)),
-            );
-        }
-        let (metric_label, unit) = match rule.metric.as_str() {
-            "cpu" => ("CPU", "%"),
-            "memory" => ("内存", "%"),
-            "disk" => ("磁盘", "%"),
-            "net_in" => ("下行", "MiB/s"),
-            "net_out" => ("上行", "MiB/s"),
-            _ => continue,
-        };
-        for value in values_by_rule.remove(&rule.id).unwrap_or_default() {
-            if !db::alert_window_covered(&value, rule.duration_minutes, current_time) {
-                continue;
-            }
-            let key = format!("{}:{}", rule.id, value.server_id);
-            evaluated_resources.insert(key.clone());
-            if value.value >= rule.threshold {
-                current.resources.insert(key.clone());
-                if !previous.resources.contains(&key) {
-                    events.push(event(
-                        format!("resource:{}:{}:{}:alert", rule.id, value.server_id, value.last_timestamp),
-                        "resource_alert",
-                        EventSource {
-                            server_id: Some(&value.server_id),
-                            server_name: &value.name,
-                        },
-                        format!("资源告警：{}", rule.name),
-                        format!("{} {:.1}{unit}，阈值 {:.1}{unit}，{} 分钟{}。", metric_label, value.value, rule.threshold, rule.duration_minutes, if rule.aggregation == "continuous" { "持续超限" } else { "窗口平均" }),
-                        json!({ "value": value.value, "threshold": rule.threshold, "rule": rule.name, "metric": rule.metric }),
-                        current_time,
-                    ));
-                }
-            } else if previous.resources.contains(&key) {
-                events.push(event(
-                    format!("resource:{}:{}:{}:recovery", rule.id, value.server_id, value.last_timestamp),
-                    "resource_recovery",
-                    EventSource {
-                        server_id: Some(&value.server_id),
-                        server_name: &value.name,
-                    },
-                    format!("资源恢复：{}", rule.name),
-                    format!("{metric_label} 已恢复到阈值以内。"),
-                    json!({ "value": value.value, "threshold": rule.threshold, "rule": rule.name, "metric": rule.metric }),
-                    current_time,
-                ));
-            }
-        }
-    }
-    for key in &previous.resources {
-        if eligible_resources.contains(key) && !evaluated_resources.contains(key) {
-            current.resources.insert(key.clone());
-        }
-    }
-    if previous != current || !events.is_empty() {
-        persist_events_and_state(db_conn, &events, &current, current_time).await?;
-    }
-    Ok(())
-}
-
-pub async fn cleanup(db_conn: &D1Database, timestamp: i64) -> Result<()> {
-    let cutoff = timestamp.saturating_sub(30 * 86_400);
-    db_conn
-        .prepare("DELETE FROM notification_events WHERE created_at<?1")
-        .bind(&[number(cutoff)])?
-        .run()
-        .await?;
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::{render_template, renewed_expiry, retry_delay, traffic_step, validate_template};
-
-    #[test]
-    fn renders_whitelisted_templates() {
-        let values = [
-            ("title", "离线".to_string()),
-            ("message", "超时".to_string()),
-        ];
-        assert_eq!(
-            render_template("{{title}}: {{message}}", &values),
-            "离线: 超时"
-        );
-        assert!(validate_template("{{unknown}}").is_some());
-        assert!(validate_template("{{ title }}").is_some());
-        assert_eq!(
-            render_template(
-                "{{server}}",
-                &[
-                    ("server", "{{title}}".to_string()),
-                    ("title", "告警".to_string())
-                ]
-            ),
-            "{{title}}"
-        );
-    }
-
-    #[test]
-    fn traffic_steps_and_retry_backoff_are_bounded() {
-        assert_eq!(traffic_step(79, 100, 80), 0);
-        assert_eq!(traffic_step(80, 100, 80), 80);
-        assert_eq!(traffic_step(89, 100, 80), 85);
-        assert_eq!(traffic_step(120, 100, 80), 100);
-        assert_eq!(
-            [
-                retry_delay(1),
-                retry_delay(2),
-                retry_delay(3),
-                retry_delay(4)
-            ],
-            [60, 300, 900, 3600]
-        );
-    }
-
-    #[test]
-    fn expiry_renewal_skips_future_dates() {
-        let day = 86_400;
-        assert_eq!(renewed_expiry(80 * day, 30, 100 * day), Some(110 * day));
-        assert_eq!(renewed_expiry(102 * day, 30, 100 * day), None);
-    }
-
-    #[test]
-    fn one_time_billing_cycle_never_renews() {
-        // 一次性（billing_cycle = 0）就算把自动续费开着也不该续：否则 clamp(1, ..)
-        // 把周期当成 1 天，每跑一次 cron 推一天，节点永远停在「剩 1 天」。
-        let day = 86_400;
-        assert_eq!(renewed_expiry(80 * day, 0, 100 * day), None);
-        assert_eq!(renewed_expiry(102 * day, 0, 101 * day), None);
-        assert_eq!(renewed_expiry(80 * day, -5, 100 * day), None);
-        // 正常周期不受影响。
-        assert_eq!(renewed_expiry(80 * day, 1, 100 * day), Some(102 * day));
-    }
-}
diff --git a/src/outbound.rs b/src/outbound.rs
deleted file mode 100644
index 8e08811..0000000
--- a/src/outbound.rs
+++ /dev/null
@@ -1,71 +0,0 @@
-use std::time::Duration;
-
-use futures_util::{future::select, pin_mut, TryStreamExt};
-use serde::de::DeserializeOwned;
-use worker::{AbortController, Delay, Error, Fetch, Request, Response, Result};
-
-const RESPONSE_BODY_TIMEOUT: Duration = Duration::from_secs(15);
-
-pub async fn fetch_with_timeout(request: Request, timeout: Duration) -> Result<Option<Response>> {
-    let controller = AbortController::default();
-    let signal = controller.signal();
-    let fetch_request = Fetch::Request(request);
-    let fetch = fetch_request.send_with_signal(&signal);
-    let delay = Delay::from(timeout);
-    pin_mut!(fetch, delay);
-
-    match select(fetch, delay).await {
-        futures_util::future::Either::Left((response, _)) => response.map(Some),
-        futures_util::future::Either::Right(((), _)) => {
-            controller.abort();
-            Ok(None)
-        }
-    }
-}
-
-pub async fn read_response_limited(
-    response: &mut Response,
-    limit: usize,
-) -> Result<Option<Vec<u8>>> {
-    let read = async {
-        let declared = response
-            .headers()
-            .get("Content-Length")?
-            .and_then(|value| value.parse::<usize>().ok());
-        if declared.is_some_and(|length| length == 0 || length > limit) {
-            return Ok(None);
-        };
-
-        let mut body = Vec::with_capacity(declared.unwrap_or(0).min(limit));
-        let mut stream = response.stream()?;
-        while let Some(mut chunk) = stream.try_next().await? {
-            let Some(length) = body.len().checked_add(chunk.len()) else {
-                return Ok(None);
-            };
-            if length > limit {
-                return Ok(None);
-            }
-            body.append(&mut chunk);
-        }
-        Ok((!body.is_empty()).then_some(body))
-    };
-    let timeout = Delay::from(RESPONSE_BODY_TIMEOUT);
-    pin_mut!(read, timeout);
-    match select(read, timeout).await {
-        futures_util::future::Either::Left((body, _)) => body,
-        futures_util::future::Either::Right(((), _)) => Err(Error::RustError(
-            "upstream response body timed out".to_string(),
-        )),
-    }
-}
-
-pub async fn read_json_limited<T: DeserializeOwned>(
-    response: &mut Response,
-    limit: usize,
-) -> Result<T> {
-    let body = read_response_limited(response, limit)
-        .await?
-        .ok_or_else(|| Error::RustError("upstream response body is empty or too large".into()))?;
-    serde_json::from_slice(&body)
-        .map_err(|error| Error::RustError(format!("upstream returned invalid JSON: {error}")))
-}
diff --git a/src/routes/admin.rs b/src/routes/admin.rs
deleted file mode 100644
index 782cd5d..0000000
--- a/src/routes/admin.rs
+++ /dev/null
@@ -1,829 +0,0 @@
-use std::collections::HashSet;
-
-use worker::{console_error, console_warn, Method, Request, Response, Result};
-
-use crate::auth::{
-    create_admin_jwt, create_theme_preview_proof, hash_password, random_salt, sha256_hex,
-};
-use crate::models::{
-    AlertRuleInput, LatencyTaskInput, ServerBatchInput, ServerInput, ServerOrderInput,
-    SettingsInput, ThemeInput, ThemeView,
-};
-use crate::routes::{RouteContext, RouteOutcome};
-use crate::{
-    cloudflare, db, env_secret_text, error, exchange, json, latency, live, no_content, notify, now,
-    request_json, server_id, settings_for_admin_response, submitted_secret, theme,
-    valid_background_urls, valid_cloudflare_account_id, valid_cloudflare_api_token,
-    valid_password_derived, valid_public_asset_url, validate_alert_rule, validate_latency_task,
-    validate_server, validate_theme, API_JSON_MAX_BYTES,
-};
-
-pub(crate) async fn route(mut req: Request, ctx: &RouteContext) -> Result<RouteOutcome> {
-    let method = req.method();
-    let path = req.path();
-
-    if !path.starts_with("/api/admin/") {
-        return Ok(RouteOutcome::Unmatched(req));
-    }
-    // 登出不需要管理员会话（仅清除 Cookie），其余管理接口一律要求授权。
-    if method == Method::Post && path == "/api/admin/logout" {
-        let mut response = no_content()?;
-        crate::set_admin_session_cookie(&mut response, &req, None)?;
-        return Ok(RouteOutcome::Handled(response));
-    }
-    if !ctx.admin {
-        return Ok(RouteOutcome::Handled(error("未授权", 401)?));
-    }
-
-    if method == Method::Get && path == "/api/admin/latency-tasks" {
-        return handled(json(
-            &serde_json::json!({ "tasks": latency::list_tasks(&ctx.database).await? }),
-            200,
-        ));
-    }
-    if method == Method::Post && path == "/api/admin/latency-tasks" {
-        return handled(latency_tasks_post(&mut req, ctx).await);
-    }
-    if (method == Method::Patch || method == Method::Delete)
-        && path.starts_with("/api/admin/latency-tasks/")
-    {
-        return handled(latency_tasks_patch_delete(&mut req, ctx, &method, &path).await);
-    }
-
-    if method == Method::Get && path == "/api/admin/alert-rules" {
-        return handled(json(
-            &serde_json::json!({ "rules": db::list_alert_rules(&ctx.database).await? }),
-            200,
-        ));
-    }
-    if method == Method::Post && path == "/api/admin/alert-rules" {
-        return handled(alert_rules_post(&mut req, ctx).await);
-    }
-    if (method == Method::Patch || method == Method::Delete)
-        && path.starts_with("/api/admin/alert-rules/")
-    {
-        return handled(alert_rules_patch_delete(&mut req, ctx, &method, &path).await);
-    }
-
-    if method == Method::Get && path == "/api/admin/telegram" {
-        return handled(json(
-            &serde_json::json!({ "telegram": notify::telegram_settings(&ctx.database).await? }),
-            200,
-        ));
-    }
-    if method == Method::Put && path == "/api/admin/telegram" {
-        return handled(telegram_put(&mut req, ctx).await);
-    }
-    if method == Method::Post && path == "/api/admin/telegram/test" {
-        return handled(telegram_test(ctx).await);
-    }
-
-    if method == Method::Get && path == "/api/admin/servers" {
-        let servers = db::list_servers(&ctx.database, true).await?;
-        return handled(json(&serde_json::json!({ "servers": servers }), 200));
-    }
-    if method == Method::Delete && path == "/api/admin/servers" {
-        return handled(servers_batch_delete(&mut req, ctx).await);
-    }
-    if method == Method::Patch && path == "/api/admin/servers/order" {
-        return handled(servers_order_patch(&mut req, ctx).await);
-    }
-    if method == Method::Post && path == "/api/admin/servers" {
-        return handled(servers_post(&mut req, ctx).await);
-    }
-    if method == Method::Get && path.starts_with("/api/admin/servers/") && path.ends_with("/token")
-    {
-        return handled(server_token_get(ctx, &path).await);
-    }
-    if (method == Method::Patch || method == Method::Delete)
-        && path.starts_with("/api/admin/servers/")
-    {
-        return handled(server_patch_delete(&mut req, ctx, &method, &path).await);
-    }
-
-    if method == Method::Get && path == "/api/admin/settings" {
-        return handled(json(
-            &settings_for_admin_response(ctx.settings.clone(), &ctx.env),
-            200,
-        ));
-    }
-    if method == Method::Patch && path == "/api/admin/settings" {
-        return handled(settings_patch(&mut req, ctx).await);
-    }
-
-    if method == Method::Get && path == "/api/admin/themes" {
-        return handled(themes_get(ctx).await);
-    }
-    if method == Method::Post && path == "/api/admin/themes" {
-        return handled(themes_post(&mut req, ctx).await);
-    }
-    if method == Method::Post
-        && path.starts_with("/api/admin/themes/")
-        && path.ends_with("/preview")
-    {
-        return handled(theme_preview_post(ctx, &path).await);
-    }
-    if method == Method::Post
-        && path.starts_with("/api/admin/themes/")
-        && path.ends_with("/activate")
-    {
-        return handled(theme_activate_post(ctx, &path).await);
-    }
-    if method == Method::Delete && path.starts_with("/api/admin/themes/") {
-        return handled(theme_delete(ctx, &path).await);
-    }
-
-    if method == Method::Get && path == "/api/admin/theme-settings" {
-        return handled(theme_settings_get(ctx).await);
-    }
-    if method == Method::Post && path == "/api/admin/exchange-rates/refresh" {
-        return handled(exchange_rates_refresh(ctx).await);
-    }
-    if method == Method::Get && path == "/api/admin/database" {
-        let stats =
-            db::database_stats(&ctx.database, ctx.settings.offline_threshold_seconds).await?;
-        return handled(json(&stats, 200));
-    }
-    if method == Method::Get && path == "/api/admin/cloudflare-usage" {
-        return handled(cloudflare_usage(ctx).await);
-    }
-    if method == Method::Delete && path == "/api/admin/history" {
-        db::clear_history(&ctx.database).await?;
-        live::clear_alert_windows(&ctx.env).await?;
-        db::increment_setting(&ctx.database, "history_cache_version").await?;
-        return handled(no_content());
-    }
-    Ok(RouteOutcome::Unmatched(req))
-}
-
-fn handled(result: Result<Response>) -> Result<RouteOutcome> {
-    result.map(RouteOutcome::Handled)
-}
-
-async fn existing_server_ids(ctx: &RouteContext) -> Result<HashSet<String>> {
-    Ok(db::list_servers(&ctx.database, true)
-        .await?
-        .into_iter()
-        .map(|server| server.id)
-        .collect())
-}
-
-fn short_durable_id(ctx: &RouteContext) -> Result<String> {
-    Ok(ctx
-        .env
-        .durable_object("LIVE_HUB")?
-        .unique_id()?
-        .to_string()
-        .chars()
-        .take(16)
-        .collect::<String>())
-}
-
-fn unique_admin_id(ctx: &RouteContext, namespace: &str) -> Result<String> {
-    let source = format!(
-        "{namespace}:{}:{}",
-        short_durable_id(ctx)?,
-        worker::Date::now().as_millis()
-    );
-    Ok(sha256_hex(&source).chars().take(24).collect())
-}
-
-async fn latency_tasks_post(req: &mut Request, ctx: &RouteContext) -> Result<Response> {
-    let input: LatencyTaskInput = match request_json(req, API_JSON_MAX_BYTES).await {
-        Ok(value) => value,
-        Err(_) => return error("延迟任务格式无效", 400),
-    };
-    if let Some(message) = validate_latency_task(&input) {
-        return error(message, 400);
-    }
-    if latency::task_count(&ctx.database).await? >= latency::MAX_LATENCY_TASKS as i64 {
-        return error("最多可创建 128 个延迟任务", 400);
-    }
-    let server_ids = existing_server_ids(ctx).await?;
-    if input.server_ids.iter().any(|id| !server_ids.contains(id)) {
-        return error("延迟任务包含不存在的服务器", 400);
-    }
-    let assigned_server_ids = input.server_ids.clone();
-    let id = unique_admin_id(ctx, "latency-task")?;
-    latency::create_task(&ctx.database, &id, &input, now()).await?;
-    if let Err(error) = live::disconnect_agents(&ctx.env, &assigned_server_ids).await {
-        console_error!("failed to refresh Agents after latency task creation: {error}");
-    }
-    db::increment_setting(&ctx.database, "history_cache_version").await?;
-    json(&serde_json::json!({ "id": id }), 201)
-}
-
-async fn latency_tasks_patch_delete(
-    req: &mut Request,
-    ctx: &RouteContext,
-    method: &Method,
-    path: &str,
-) -> Result<Response> {
-    let Some(id) = server_id(path, "/api/admin/latency-tasks/") else {
-        return error("延迟任务 ID 无效", 400);
-    };
-    if *method == Method::Delete {
-        let assigned_server_ids = latency::server_ids_for_task(&ctx.database, &id).await?;
-        return if latency::delete_task(&ctx.database, &id).await? {
-            if let Err(error) = live::disconnect_agents(&ctx.env, &assigned_server_ids).await {
-                console_error!("failed to refresh Agents after latency task deletion: {error}");
-            }
-            db::increment_setting(&ctx.database, "history_cache_version").await?;
-            no_content()
-        } else {
-            error("延迟任务不存在", 404)
-        };
-    }
-    let input: LatencyTaskInput = match request_json(req, API_JSON_MAX_BYTES).await {
-        Ok(value) => value,
-        Err(_) => return error("延迟任务格式无效", 400),
-    };
-    if let Some(message) = validate_latency_task(&input) {
-        return error(message, 400);
-    }
-    let server_ids = existing_server_ids(ctx).await?;
-    if input
-        .server_ids
-        .iter()
-        .any(|server_id| !server_ids.contains(server_id))
-    {
-        return error("延迟任务包含不存在的服务器", 400);
-    }
-    let mut affected_server_ids = latency::server_ids_for_task(&ctx.database, &id).await?;
-    affected_server_ids.extend(input.server_ids.iter().cloned());
-    affected_server_ids.sort();
-    affected_server_ids.dedup();
-    if latency::update_task(&ctx.database, &id, &input, now()).await? {
-        if let Err(error) = live::disconnect_agents(&ctx.env, &affected_server_ids).await {
-            console_error!("failed to refresh Agents after latency task update: {error}");
-        }
-        db::increment_setting(&ctx.database, "history_cache_version").await?;
-        no_content()
-    } else {
-        error("延迟任务不存在", 404)
-    }
-}
-
-async fn alert_rules_post(req: &mut Request, ctx: &RouteContext) -> Result<Response> {
-    if db::list_alert_rules(&ctx.database).await?.len() >= 20 {
-        return error("最多可创建 20 条资源告警规则", 400);
-    }
-    let input: AlertRuleInput = match request_json(req, API_JSON_MAX_BYTES).await {
-        Ok(value) => value,
-        Err(_) => return error("告警规则格式无效", 400),
-    };
-    if let Some(message) = validate_alert_rule(&input) {
-        return error(message, 400);
-    }
-    let server_ids = existing_server_ids(ctx).await?;
-    if input.server_ids.iter().any(|id| !server_ids.contains(id)) {
-        return error("告警规则包含不存在的服务器", 400);
-    }
-    let id = short_durable_id(ctx)?;
-    db::create_alert_rule(&ctx.database, &id, &input).await?;
-    json(&serde_json::json!({ "id": id }), 201)
-}
-
-async fn alert_rules_patch_delete(
-    req: &mut Request,
-    ctx: &RouteContext,
-    method: &Method,
-    path: &str,
-) -> Result<Response> {
-    let Some(id) = server_id(path, "/api/admin/alert-rules/") else {
-        return error("告警规则 ID 无效", 400);
-    };
-    if *method == Method::Delete {
-        return if db::delete_alert_rule(&ctx.database, &id).await? {
-            no_content()
-        } else {
-            error("告警规则不存在", 404)
-        };
-    }
-    let input: AlertRuleInput = match request_json(req, API_JSON_MAX_BYTES).await {
-        Ok(value) => value,
-        Err(_) => return error("告警规则格式无效", 400),
-    };
-    if let Some(message) = validate_alert_rule(&input) {
-        return error(message, 400);
-    }
-    let server_ids = existing_server_ids(ctx).await?;
-    if input
-        .server_ids
-        .iter()
-        .any(|server_id| !server_ids.contains(server_id))
-    {
-        return error("告警规则包含不存在的服务器", 400);
-    }
-    if db::update_alert_rule(&ctx.database, &id, &input).await? {
-        no_content()
-    } else {
-        error("告警规则不存在", 404)
-    }
-}
-
-async fn servers_batch_delete(req: &mut Request, ctx: &RouteContext) -> Result<Response> {
-    let input: ServerBatchInput = match request_json(req, API_JSON_MAX_BYTES).await {
-        Ok(value) => value,
-        Err(_) => return error("批量删除格式无效", 400),
-    };
-    if input.ids.is_empty()
-        || input.ids.len() > 500
-        || input.ids.iter().any(|id| id.is_empty() || id.len() > 80)
-        || input.ids.iter().collect::<HashSet<_>>().len() != input.ids.len()
-    {
-        return error("批量删除列表无效", 400);
-    }
-    db::delete_servers(&ctx.database, &input.ids).await?;
-    if let Err(error) = live::disconnect_agents(&ctx.env, &input.ids).await {
-        console_error!("failed to disconnect deleted Agents: {error}");
-    }
-    if let Err(error) = live::remove_alert_samples(&ctx.env, &input.ids).await {
-        console_error!("failed to remove deleted Agent alert samples: {error}");
-    }
-    no_content()
-}
-
-async fn servers_order_patch(req: &mut Request, ctx: &RouteContext) -> Result<Response> {
-    let input: ServerOrderInput = match request_json(req, API_JSON_MAX_BYTES).await {
-        Ok(value) => value,
-        Err(_) => return error("排序格式无效", 400),
-    };
-    if input.ids.len() > 500
-        || input.ids.iter().any(|id| id.is_empty() || id.len() > 80)
-        || input.ids.iter().collect::<HashSet<_>>().len() != input.ids.len()
-    {
-        return error("节点排序列表无效", 400);
-    }
-    let current = db::list_servers(&ctx.database, true).await?;
-    let current_ids: HashSet<_> = current.iter().map(|server| &server.id).collect();
-    if input.ids.len() != current_ids.len() || input.ids.iter().any(|id| !current_ids.contains(id))
-    {
-        return error("排序列表必须包含全部节点", 400);
-    }
-    db::reorder_servers(&ctx.database, &input.ids).await?;
-    no_content()
-}
-
-async fn servers_post(req: &mut Request, ctx: &RouteContext) -> Result<Response> {
-    let input: ServerInput = match request_json(req, API_JSON_MAX_BYTES).await {
-        Ok(value) => value,
-        Err(_) => return error("节点格式无效", 400),
-    };
-    if let Some(message) = validate_server(&input) {
-        return error(message, 400);
-    }
-    let id = short_durable_id(ctx)?;
-    let token = ctx.env.durable_object("LIVE_HUB")?.unique_id()?.to_string();
-    db::create_server(&ctx.database, &id, &token, &input).await?;
-    latency::assign_defaults(&ctx.database, &id).await?;
-    json(&serde_json::json!({ "id": id, "agent_token": token }), 201)
-}
-
-async fn server_token_get(ctx: &RouteContext, path: &str) -> Result<Response> {
-    let id = path
-        .strip_prefix("/api/admin/servers/")
-        .and_then(|value| value.strip_suffix("/token"))
-        .unwrap_or_default();
-    if id.is_empty() || id.contains('/') || id.len() > 80 {
-        return error("节点 ID 无效", 400);
-    }
-    match db::get_agent_token(&ctx.database, id).await? {
-        Some(token) => json(&serde_json::json!({ "agent_token": token }), 200),
-        None => error("节点不存在", 404),
-    }
-}
-
-async fn server_patch_delete(
-    req: &mut Request,
-    ctx: &RouteContext,
-    method: &Method,
-    path: &str,
-) -> Result<Response> {
-    let Some(id) = server_id(path, "/api/admin/servers/") else {
-        return error("节点 ID 无效", 400);
-    };
-    if *method == Method::Delete {
-        if !db::delete_server(&ctx.database, &id).await? {
-            return error("节点不存在", 404);
-        }
-        if let Err(error) = live::disconnect_agents(&ctx.env, std::slice::from_ref(&id)).await {
-            console_error!("failed to disconnect deleted Agent: {error}");
-        }
-        if let Err(error) = live::remove_alert_samples(&ctx.env, std::slice::from_ref(&id)).await {
-            console_error!("failed to remove deleted Agent alert samples: {error}");
-        }
-        return no_content();
-    }
-    let input: ServerInput = match request_json(req, API_JSON_MAX_BYTES).await {
-        Ok(value) => value,
-        Err(_) => return error("节点格式无效", 400),
-    };
-    if let Some(message) = validate_server(&input) {
-        return error(message, 400);
-    }
-    if !db::update_server(&ctx.database, &id, &input).await? {
-        return error("节点不存在", 404);
-    }
-    if let Err(error) = live::disconnect_agents(&ctx.env, std::slice::from_ref(&id)).await {
-        console_error!("failed to reconnect updated Agent: {error}");
-    }
-    no_content()
-}
-
-async fn themes_get(ctx: &RouteContext) -> Result<Response> {
-    let mut themes = vec![ThemeView {
-        id: theme::BUILTIN_THEME_ID.to_string(),
-        name: theme::BUILTIN_THEME_NAME.to_string(),
-        description: "默认主题".to_string(),
-        url: String::new(),
-        version: crate::VERSION.to_string(),
-        builtin: true,
-        active: ctx.settings.active_theme_id == theme::BUILTIN_THEME_ID,
-    }];
-    themes.extend(db::list_themes(&ctx.database, &ctx.settings.active_theme_id).await?);
-    json(&serde_json::json!({ "themes": themes }), 200)
-}
-
-async fn themes_post(req: &mut Request, ctx: &RouteContext) -> Result<Response> {
-    if db::list_themes(&ctx.database, &ctx.settings.active_theme_id)
-        .await?
-        .len()
-        >= 32
-    {
-        return error("最多可添加 32 个第三方主题", 400);
-    }
-    let input: ThemeInput = match request_json(req, API_JSON_MAX_BYTES).await {
-        Ok(value) => value,
-        Err(_) => return error("主题格式无效", 400),
-    };
-    if let Some(message) = validate_theme(&input) {
-        return error(message, 400);
-    }
-    let resolved = match theme::resolve_url(&input.url) {
-        Ok(value) => value,
-        Err(err) => {
-            console_warn!("theme URL resolution failed: {err}");
-            return error("无法解析主题地址，请检查 URL", 422);
-        }
-    };
-    let digest = sha256_hex(&resolved.source_url);
-    let id = format!("theme-{}", &digest[..16]);
-    if db::theme_exists(&ctx.database, &id).await? {
-        return error("该主题 URL 已添加", 409);
-    }
-    if let Err(err) = theme::validate_remote(&resolved.resolved_url).await {
-        console_warn!(
-            "theme validation failed for {}: {err}",
-            resolved.resolved_url
-        );
-        return error("无法读取主题 index.html，请检查 URL 和主题构建产物", 422);
-    }
-    let version = theme::remote_theme_version(&resolved.resolved_url)
-        .await
-        .unwrap_or_default();
-    db::create_theme(
-        &ctx.database,
-        &id,
-        &input,
-        &resolved.source_url,
-        &version,
-        now(),
-    )
-    .await?;
-    json(&serde_json::json!({ "id": id }), 201)
-}
-
-async fn theme_preview_post(ctx: &RouteContext, path: &str) -> Result<Response> {
-    let id = path
-        .strip_prefix("/api/admin/themes/")
-        .and_then(|value| value.strip_suffix("/preview"))
-        .unwrap_or("")
-        .trim_matches('/');
-    if id.is_empty() || id.contains('/') || id.len() > 80 {
-        return error("主题 ID 无效", 400);
-    }
-    if id == theme::BUILTIN_THEME_ID || !db::theme_exists(&ctx.database, id).await? {
-        return error("远程主题不存在", 404);
-    }
-    let Some(proof) = create_theme_preview_proof(&ctx.env, &ctx.settings.admin_password_hash, id)
-    else {
-        return error("无法创建主题预览凭据", 503);
-    };
-    json(
-        &serde_json::json!({
-            "preview_url": format!("/__theme-preview/{proof}/")
-        }),
-        200,
-    )
-}
-
-async fn theme_activate_post(ctx: &RouteContext, path: &str) -> Result<Response> {
-    let id = path
-        .strip_prefix("/api/admin/themes/")
-        .and_then(|value| value.strip_suffix("/activate"))
-        .unwrap_or("")
-        .trim_matches('/');
-    if id.is_empty() || id.contains('/') || id.len() > 80 {
-        return error("主题 ID 无效", 400);
-    }
-    if id != theme::BUILTIN_THEME_ID {
-        let Some(url) = db::theme_url(&ctx.database, id).await? else {
-            return error("主题不存在", 404);
-        };
-        if let Err(err) = theme::validate_remote(&url).await {
-            console_warn!("theme activation failed for {url}: {err}");
-            return error("主题当前不可访问，未切换主题", 422);
-        }
-        if let Some(version) = theme::remote_theme_version(&url).await {
-            if let Err(err) = db::update_theme_version(&ctx.database, id, &version).await {
-                console_warn!("theme version refresh failed for {id}: {err}");
-            }
-        }
-    }
-    if !db::set_active_theme(&ctx.database, id).await? {
-        return error("主题不存在", 404);
-    }
-    no_content()
-}
-
-async fn theme_delete(ctx: &RouteContext, path: &str) -> Result<Response> {
-    let Some(id) = server_id(path, "/api/admin/themes/") else {
-        return error("主题 ID 无效", 400);
-    };
-    if id == theme::BUILTIN_THEME_ID {
-        return error("内置主题不能删除", 400);
-    }
-    if db::delete_theme(&ctx.database, &id).await? {
-        no_content()
-    } else {
-        error("主题不存在", 404)
-    }
-}
-
-async fn theme_settings_get(ctx: &RouteContext) -> Result<Response> {
-    if ctx.settings.active_theme_id == theme::BUILTIN_THEME_ID {
-        return json(&theme::builtin_settings_schema(), 200);
-    }
-    let Some(url) = db::theme_url(&ctx.database, &ctx.settings.active_theme_id).await? else {
-        return error("当前主题不存在", 404);
-    };
-    match theme::remote_settings_schema(&url).await {
-        Ok(schema) => json(&schema, 200),
-        Err(err) => {
-            console_warn!("theme settings validation failed for {url}: {err}");
-            error("当前主题的 theme.json 设置格式无效", 422)
-        }
-    }
-}
-
-async fn exchange_rates_refresh(ctx: &RouteContext) -> Result<Response> {
-    match exchange::refresh(&ctx.database, now(), true).await {
-        Ok((rates, _)) => json(&rates, 200),
-        Err(err) => {
-            console_error!("manual exchange-rate refresh failed: {err}");
-            error("汇率更新失败，已保留数据库中的旧汇率", 502)
-        }
-    }
-}
-
-async fn cloudflare_usage(ctx: &RouteContext) -> Result<Response> {
-    let account_id = if ctx.settings.cloudflare_account_id.trim().is_empty() {
-        env_secret_text(&ctx.env, "CF_USAGE_ACCOUNT_ID")
-    } else {
-        ctx.settings.cloudflare_account_id.clone()
-    };
-    let token = if ctx.settings.cloudflare_api_token.trim().is_empty() {
-        env_secret_text(&ctx.env, "CF_USAGE_API_TOKEN")
-    } else {
-        ctx.settings.cloudflare_api_token.clone()
-    };
-    if account_id.trim().is_empty() || token.trim().is_empty() {
-        return error("尚未配置 Cloudflare 用量查询凭据", 503);
-    }
-    match cloudflare::usage(token.trim(), account_id.trim(), now()).await {
-        Ok(usage) => json(&usage, 200),
-        Err(err) => {
-            console_error!("cloudflare usage query failed: {err}");
-            let detail = err.to_string().chars().take(240).collect::<String>();
-            error(&format!("Cloudflare 用量查询失败：{detail}"), 502)
-        }
-    }
-}
-
-async fn telegram_put(req: &mut Request, ctx: &RouteContext) -> Result<Response> {
-    let input: crate::models::TelegramNotificationInput =
-        match request_json(req, API_JSON_MAX_BYTES).await {
-            Ok(value) => value,
-            Err(_) => return error("Telegram 配置格式无效", 400),
-        };
-    match notify::save_telegram(&ctx.database, &input, now()).await? {
-        Ok(()) => no_content(),
-        Err(message) => error(&message, 400),
-    }
-}
-
-async fn telegram_test(ctx: &RouteContext) -> Result<Response> {
-    match notify::test_telegram(
-        &ctx.database,
-        &unique_admin_id(ctx, "notification-test")?,
-        now(),
-    )
-    .await?
-    {
-        Ok(()) => no_content(),
-        Err(message) => error(&format!("Telegram 测试消息发送失败：{message}"), 502),
-    }
-}
-
-async fn settings_patch(req: &mut Request, ctx: &RouteContext) -> Result<Response> {
-    let settings = &ctx.settings;
-    let input: SettingsInput = match request_json(req, API_JSON_MAX_BYTES).await {
-        Ok(value) => value,
-        Err(_) => return error("设置格式无效", 400),
-    };
-    if input
-        .site_name
-        .as_ref()
-        .is_some_and(|value| value.trim().is_empty() || value.chars().count() > 80)
-    {
-        return error("站点名称长度应为 1 至 80 个字符", 400);
-    }
-    if input
-        .site_description
-        .as_ref()
-        .is_some_and(|value| value.chars().count() > 240)
-    {
-        return error("站点描述不能超过 240 个字符", 400);
-    }
-    if input
-        .site_announcement
-        .as_ref()
-        .is_some_and(|value| value.chars().count() > 1000)
-    {
-        return error("站点公告不能超过 1000 个字符", 400);
-    }
-    // logo_url 同时作为站点 Logo 和浏览器标签图标使用。
-    if input
-        .logo_url
-        .as_deref()
-        .is_some_and(|value| !valid_public_asset_url(value))
-    {
-        return error("站点 Logo 必须使用 HTTPS 地址", 400);
-    }
-    if input
-        .default_theme
-        .as_deref()
-        .is_some_and(|value| !matches!(value, "system" | "light" | "dark"))
-    {
-        return error("默认主题无效", 400);
-    }
-    if let Some(id) = input.active_theme_id.as_deref() {
-        let valid = id == theme::BUILTIN_THEME_ID || db::theme_exists(&ctx.database, id).await?;
-        if !valid {
-            return error("活动主题不存在", 400);
-        }
-    }
-    if input
-        .background_url
-        .as_deref()
-        .is_some_and(|value| !valid_background_urls(value))
-    {
-        return error(
-            "背景地址无效：请使用 HTTPS 地址，浅色和深色可用 | 分隔",
-            400,
-        );
-    }
-    if input.theme_options.as_ref().is_some_and(|value| {
-        let Some(options) = value.as_object() else {
-            return true;
-        };
-        options.len() > 40
-            || value.to_string().len() > 12_000
-            || options.iter().any(|(key, value)| {
-                key.is_empty()
-                    || key.len() > 64
-                    || !key
-                        .chars()
-                        .all(|ch| ch.is_ascii_alphanumeric() || matches!(ch, '_' | '-'))
-                    || !(value.is_boolean()
-                        || value.is_number()
-                        || value
-                            .as_str()
-                            .is_some_and(|text| text.chars().count() <= 500))
-            })
-    }) {
-        return error("主题设置格式无效", 400);
-    }
-    if input.admin_username.as_ref().is_some_and(|value| {
-        value.trim().is_empty()
-            || value.chars().count() > 64
-            || value.chars().any(char::is_whitespace)
-    }) {
-        return error("用户名应为 1 至 64 个不含空格的字符", 400);
-    }
-    if input
-        .new_password
-        .as_ref()
-        .is_some_and(|value| !value.is_empty() && !(8..=128).contains(&value.chars().count()))
-    {
-        return error("新密码长度应为 8 至 128 个字符", 400);
-    }
-    if input
-        .new_password
-        .as_ref()
-        .is_some_and(|value| !value.is_empty())
-        && input
-            .new_password_derived
-            .as_deref()
-            .is_none_or(|value| !valid_password_derived(value))
-    {
-        return error("新密码派生值无效", 400);
-    }
-    let configured_site_key = submitted_secret(
-        input.turnstile_site_key.as_deref(),
-        &settings.turnstile_site_key,
-    );
-    let configured_secret_key = submitted_secret(
-        input.turnstile_secret_key.as_deref(),
-        &settings.turnstile_secret_key,
-    );
-    let site_key = if configured_site_key.is_empty() {
-        ctx.environment_turnstile_site_key.trim()
-    } else {
-        configured_site_key
-    };
-    let secret_key = if configured_secret_key.is_empty() {
-        ctx.environment_turnstile_secret_key.trim()
-    } else {
-        configured_secret_key
-    };
-    let protection_activated = input.turnstile_enabled == Some(true) && !settings.turnstile_enabled
-        || input.turnstile_login_enabled == Some(true) && !settings.turnstile_login_enabled;
-    if protection_activated && (site_key.is_empty() || secret_key.is_empty()) {
-        return error("启用 Turnstile 前必须填写站点密钥和私钥", 400);
-    }
-    if input
-        .traffic_alert_percentage
-        .is_some_and(|value| !(50..=100).contains(&value))
-    {
-        return error("流量提醒起始阈值应为 50 至 100", 400);
-    }
-    if input
-        .cloudflare_account_id
-        .as_deref()
-        .is_some_and(|value| !valid_cloudflare_account_id(value))
-    {
-        return error("Cloudflare Account ID 应为 32 位十六进制字符", 400);
-    }
-    if input
-        .cloudflare_api_token
-        .as_deref()
-        .is_some_and(|value| value.trim() != db::SECRET_MASK && !valid_cloudflare_api_token(value))
-    {
-        return error("Cloudflare API Token 格式无效", 400);
-    }
-    if input
-        .locale
-        .as_deref()
-        .is_some_and(|value| !matches!(value, "zh-CN" | "en"))
-    {
-        return error("界面语言仅支持简体中文或 English", 400);
-    }
-    let password_hash = if input
-        .new_password
-        .as_ref()
-        .is_some_and(|value| !value.is_empty())
-    {
-        let password_derived = input.new_password_derived.as_deref().unwrap_or_default();
-        let Some(salt) = random_salt() else {
-            return error("运行时随机源不可用，无法保存新密码", 503);
-        };
-        Some(hash_password(password_derived, &salt))
-    } else {
-        None
-    };
-    db::update_settings(&ctx.database, &input, password_hash.as_deref()).await?;
-    let updated = db::settings(
-        &ctx.database,
-        &ctx.default_name,
-        ctx.default_threshold,
-        ctx.default_retention,
-        &ctx.default_username,
-    )
-    .await?;
-    let token = if password_hash.is_some() {
-        create_admin_jwt(&ctx.env, &updated.admin_password_hash)
-    } else {
-        None
-    };
-    let response_settings = settings_for_admin_response(updated, &ctx.env);
-    let mut response = json(
-        &serde_json::json!({ "settings": response_settings, "token": token }),
-        200,
-    )?;
-    if let Some(token) = token.as_deref() {
-        crate::set_admin_session_cookie(&mut response, req, Some(token))?;
-    }
-    Ok(response)
-}
diff --git a/src/routes/agent.rs b/src/routes/agent.rs
deleted file mode 100644
index 21ed33d..0000000
--- a/src/routes/agent.rs
+++ /dev/null
@@ -1,25 +0,0 @@
-use std::net::IpAddr;
-
-use worker::{D1Database, Env, Request, Response, Result};
-
-use crate::auth::bearer_token;
-use crate::db;
-use crate::live;
-use crate::{client_ip, error};
-
-pub(crate) async fn websocket(req: Request, env: &Env, database: &D1Database) -> Result<Response> {
-    let token = match bearer_token(&req) {
-        Some(value) => value,
-        None => return error("缺少 Agent Token", 401),
-    };
-    let Some(identity) = db::get_agent_identity(database, &token).await? else {
-        return error("Agent Token 无效", 401);
-    };
-    if let Some(ip) = client_ip(&req).and_then(|value| value.parse::<IpAddr>().ok()) {
-        db::update_last_ip(database, &identity.id, &ip.to_string()).await?;
-    }
-    let Some(context) = db::agent_live_context(database, &identity.id).await? else {
-        return error("节点不存在", 404);
-    };
-    live::upgrade_agent(req, env, &identity.id, identity.hidden != 0, context).await
-}
diff --git a/src/routes/mod.rs b/src/routes/mod.rs
deleted file mode 100644
index 8b49140..0000000
--- a/src/routes/mod.rs
+++ /dev/null
@@ -1,32 +0,0 @@
-pub(crate) mod admin;
-pub(crate) mod agent;
-pub(crate) mod public;
-pub(crate) mod site;
-
-use crate::db;
-use worker::{D1Database, Env, Request, Response};
-
-/// 每个请求加载一次的共享状态，按引用传给各路由处理函数。
-pub(crate) struct RouteContext {
-    pub env: Env,
-    pub database: D1Database,
-    pub settings: db::SettingsView,
-    pub admin: bool,
-    pub turnstile_verified: bool,
-    pub turnstile_site_key: String,
-    pub turnstile_secret_key: String,
-    pub public_turnstile_enabled: bool,
-    pub login_protection_enabled: bool,
-    pub environment_turnstile_site_key: String,
-    pub environment_turnstile_secret_key: String,
-    pub default_name: String,
-    pub default_threshold: i64,
-    pub default_retention: i64,
-    pub default_username: String,
-}
-
-/// WebSocket 升级等终端路由会按值消费 Request，未匹配时原样归还给调用方。
-pub(crate) enum RouteOutcome {
-    Handled(Response),
-    Unmatched(Request),
-}
diff --git a/src/routes/public.rs b/src/routes/public.rs
deleted file mode 100644
index add0db4..0000000
--- a/src/routes/public.rs
+++ /dev/null
@@ -1,403 +0,0 @@
-use std::collections::{HashMap, HashSet};
-
-use serde::Deserialize;
-use worker::{Method, Request, Response, Result};
-
-use crate::auth::{
-    create_admin_jwt, create_turnstile_proof, hash_password, random_salt, verify_credentials,
-};
-use crate::client_ip;
-use crate::models::LoginRequest;
-use crate::routes::{RouteContext, RouteOutcome};
-use crate::turnstile;
-use crate::{
-    cached_history_response, db, error, history_cache_key, history_cache_seconds, json, latency,
-    live, no_content, now, public_server, request_json, requested_hours, server_id,
-    set_admin_session_cookie, store_history_response, API_JSON_MAX_BYTES,
-};
-
-const MAX_WAKE_SERVER_IDS: usize = 500;
-
-#[derive(Deserialize)]
-struct WakeServersRequest {
-    server_ids: Vec<String>,
-}
-
-fn request_hostname(req: &Request) -> Option<String> {
-    req.url()
-        .ok()?
-        .host_str()
-        .map(|hostname| hostname.to_string())
-}
-
-pub(crate) async fn route(mut req: Request, ctx: &RouteContext) -> Result<RouteOutcome> {
-    let method = req.method();
-    let path = req.path();
-
-    if method == Method::Get && path == "/api/bootstrap" {
-        return Ok(RouteOutcome::Handled(bootstrap(ctx).await?));
-    }
-    if method == Method::Get && path == "/api/config" {
-        return Ok(RouteOutcome::Handled(config(ctx)?));
-    }
-    if method == Method::Post && path == "/api/admin/login" {
-        return Ok(RouteOutcome::Handled(admin_login(&mut req, ctx).await?));
-    }
-    if method == Method::Post && path == "/api/turnstile/verify" {
-        return Ok(RouteOutcome::Handled(
-            turnstile_verify(&mut req, ctx).await?,
-        ));
-    }
-    if method == Method::Get && path == "/api/exchange-rates" {
-        return Ok(RouteOutcome::Handled(exchange_rates(ctx).await?));
-    }
-    if method == Method::Get && path == "/api/ws" {
-        if !ctx.turnstile_verified {
-            return Ok(RouteOutcome::Handled(error(
-                "请先完成 Cloudflare 人机验证",
-                403,
-            )?));
-        }
-        if !ctx.settings.public_dashboard && !ctx.admin {
-            return Ok(RouteOutcome::Handled(error("此仪表盘需要登录后访问", 401)?));
-        }
-        return Ok(RouteOutcome::Handled(live::upgrade(req, &ctx.env).await?));
-    }
-    if method == Method::Post && path == "/api/live/wake" {
-        return Ok(RouteOutcome::Handled(wake_servers(&mut req, ctx).await?));
-    }
-    if method == Method::Get && path == "/api/servers" {
-        return Ok(RouteOutcome::Handled(servers(ctx).await?));
-    }
-    if method == Method::Get && path.starts_with("/api/history/") {
-        return Ok(RouteOutcome::Handled(history(&req, ctx).await?));
-    }
-    if method == Method::Get && path.starts_with("/api/latency/") {
-        return Ok(RouteOutcome::Handled(latency(&req, ctx).await?));
-    }
-    Ok(RouteOutcome::Unmatched(req))
-}
-
-fn public_access_denied(ctx: &RouteContext) -> Option<Result<Response>> {
-    if !ctx.turnstile_verified {
-        return Some(error("请先完成 Cloudflare 人机验证", 403));
-    }
-    if !ctx.settings.public_dashboard && !ctx.admin {
-        return Some(error("此仪表盘需要登录后访问", 401));
-    }
-    None
-}
-
-fn config_value(ctx: &RouteContext) -> serde_json::Value {
-    let settings = &ctx.settings;
-    serde_json::json!({
-        "site_name": settings.site_name,
-        "site_description": settings.site_description,
-        "site_announcement": settings.site_announcement,
-        "logo_url": settings.logo_url,
-        "locale": settings.locale,
-        "public_dashboard": settings.public_dashboard,
-        "offline_threshold_seconds": settings.offline_threshold_seconds,
-        "history_retention_days": settings.history_retention_days,
-        "default_theme": settings.default_theme,
-        "active_theme_id": settings.active_theme_id,
-        "background_url": settings.background_url,
-        "theme_options": settings.theme_options,
-        "show_search": settings.show_search,
-        "show_groups": settings.show_groups,
-        "show_stats": settings.show_stats,
-        "show_assets": settings.show_assets,
-        "show_traffic": settings.show_traffic,
-        "show_speed": settings.show_speed,
-        "show_price": settings.show_price,
-        "show_expiry": settings.show_expiry,
-        "show_latency": settings.show_latency,
-        "show_uptime": settings.show_uptime,
-        "turnstile_enabled": ctx.public_turnstile_enabled,
-        "turnstile_login_enabled": ctx.login_protection_enabled || ctx.public_turnstile_enabled,
-        "turnstile_site_key": ctx.turnstile_site_key,
-        "password_client_salt": settings.password_client_salt
-    })
-}
-
-fn config(ctx: &RouteContext) -> Result<Response> {
-    let mut response = json(&config_value(ctx), 200)?;
-    response
-        .headers_mut()
-        .set("X-NodeFlare-Server-Time", &now().to_string())?;
-    Ok(response)
-}
-
-async fn server_values(ctx: &RouteContext) -> Result<Vec<serde_json::Value>> {
-    let raw_servers = db::list_servers(&ctx.database, false).await?;
-    let mut latency_by_server: HashMap<String, Vec<latency::LatencySample>> = HashMap::new();
-    for sample in latency::latest_all(&ctx.database).await? {
-        latency_by_server
-            .entry(sample.server_id.clone())
-            .or_default()
-            .push(sample);
-    }
-    raw_servers
-        .into_iter()
-        .map(|server| {
-            let samples = latency_by_server.remove(&server.id).unwrap_or_default();
-            serde_json::to_value(public_server(server, samples)).map_err(Into::into)
-        })
-        .collect()
-}
-
-async fn bootstrap(ctx: &RouteContext) -> Result<Response> {
-    let access = if !ctx.turnstile_verified {
-        "turnstile"
-    } else if !ctx.settings.public_dashboard && !ctx.admin {
-        "login"
-    } else {
-        "ok"
-    };
-    let config = config_value(ctx);
-    if access != "ok" {
-        return json(
-            &serde_json::json!({
-                "config": config,
-                "access": access,
-                "servers": [],
-                "exchange_rates": null
-            }),
-            200,
-        );
-    }
-    let servers = server_values(ctx).await?;
-    let exchange_rates = crate::exchange::current(&ctx.database, now()).await?;
-    json(
-        &serde_json::json!({
-            "config": config,
-            "access": access,
-            "servers": servers,
-            "exchange_rates": exchange_rates
-        }),
-        200,
-    )
-}
-
-async fn admin_login(req: &mut Request, ctx: &RouteContext) -> Result<Response> {
-    let settings = &ctx.settings;
-    if settings.admin_username.trim().is_empty() {
-        return error("尚未配置 ADMIN_USERNAME", 503);
-    }
-    if settings.admin_password_hash.is_empty() && ctx.env.secret("ADMIN_PASSWORD").is_err() {
-        return error("尚未配置 ADMIN_PASSWORD", 503);
-    }
-    let input: LoginRequest = match request_json(req, API_JSON_MAX_BYTES).await {
-        Ok(value) => value,
-        Err(_) => return error("请求格式无效", 400),
-    };
-    if input.username.trim().is_empty()
-        || input.password.is_empty()
-        || !crate::valid_password_derived(&input.password_derived)
-    {
-        return error("请输入用户名和密码", 400);
-    }
-    let login_turnstile_enabled = ctx.public_turnstile_enabled || ctx.login_protection_enabled;
-    if login_turnstile_enabled {
-        let Some(hostname) = request_hostname(req) else {
-            return error("请求主机名无效", 400);
-        };
-        let verified = turnstile::verify(
-            &input.turnstile_token,
-            &ctx.turnstile_secret_key,
-            client_ip(req).as_deref(),
-            &hostname,
-            turnstile::ADMIN_LOGIN_ACTION,
-        )
-        .await
-        .unwrap_or(false);
-        if !verified {
-            return error("Cloudflare 人机验证失败，请重试", 403);
-        }
-    }
-    if !verify_credentials(
-        &ctx.env,
-        &settings.admin_username,
-        &settings.admin_password_hash,
-        &input.username,
-        &input.password,
-        &input.password_derived,
-    ) {
-        return error("用户名或密码错误", 401);
-    }
-    let session_password_hash = if settings.admin_password_hash.is_empty() {
-        let Some(salt) = random_salt() else {
-            return error("运行时随机源不可用，无法初始化管理员密码", 503);
-        };
-        let password_hash = hash_password(&input.password_derived, &salt);
-        db::save_setting(&ctx.database, "admin_password_hash", &password_hash).await?;
-        password_hash
-    } else {
-        settings.admin_password_hash.clone()
-    };
-    let Some(token) = create_admin_jwt(&ctx.env, &session_password_hash) else {
-        return error("会话密钥未配置", 503);
-    };
-    let mut response = json(&serde_json::json!({ "token": token }), 200)?;
-    set_admin_session_cookie(&mut response, req, Some(&token))?;
-    Ok(response)
-}
-
-async fn turnstile_verify(req: &mut Request, ctx: &RouteContext) -> Result<Response> {
-    if !ctx.public_turnstile_enabled {
-        return error("全站人机验证未启用", 400);
-    }
-    let input: crate::models::TurnstileVerifyRequest =
-        match request_json(req, API_JSON_MAX_BYTES).await {
-            Ok(value) => value,
-            Err(_) => return error("验证请求格式无效", 400),
-        };
-    let Some(hostname) = request_hostname(req) else {
-        return error("请求主机名无效", 400);
-    };
-    let verified = turnstile::verify(
-        &input.token,
-        &ctx.turnstile_secret_key,
-        client_ip(req).as_deref(),
-        &hostname,
-        turnstile::PUBLIC_DASHBOARD_ACTION,
-    )
-    .await
-    .unwrap_or(false);
-    if !verified {
-        return error("Cloudflare 人机验证失败，请重试", 403);
-    }
-    let Some(proof) = create_turnstile_proof(&ctx.env, &ctx.settings.admin_password_hash) else {
-        return error("验证凭据签名失败", 503);
-    };
-    let secure = req.url().ok().is_some_and(|url| url.scheme() == "https");
-    let mut response = no_content()?;
-    response.headers_mut().append(
-        "Set-Cookie",
-        &format!(
-            "nodeflare_turnstile={proof}; Path=/; Max-Age=3600; HttpOnly{}; SameSite=Strict",
-            if secure { "; Secure" } else { "" }
-        ),
-    )?;
-    Ok(response)
-}
-
-async fn exchange_rates(ctx: &RouteContext) -> Result<Response> {
-    if let Some(denied) = public_access_denied(ctx) {
-        return denied;
-    }
-    let rates = crate::exchange::current(&ctx.database, now()).await?;
-    let mut response = json(&rates, 200)?;
-    if ctx.settings.public_dashboard {
-        response
-            .headers_mut()
-            .set("Cache-Control", "public, max-age=300")?;
-    }
-    Ok(response)
-}
-
-async fn servers(ctx: &RouteContext) -> Result<Response> {
-    if let Some(denied) = public_access_denied(ctx) {
-        return denied;
-    }
-    let servers = server_values(ctx).await?;
-    json(&serde_json::json!({ "servers": servers }), 200)
-}
-
-async fn wake_servers(req: &mut Request, ctx: &RouteContext) -> Result<Response> {
-    if let Some(denied) = public_access_denied(ctx) {
-        return denied;
-    }
-    let input: WakeServersRequest = match request_json(req, API_JSON_MAX_BYTES).await {
-        Ok(value) => value,
-        Err(_) => return error("请求格式无效", 400),
-    };
-    if input.server_ids.len() > MAX_WAKE_SERVER_IDS
-        || input
-            .server_ids
-            .iter()
-            .any(|id| id.is_empty() || id.len() > 80 || id.contains('/'))
-        || input.server_ids.iter().collect::<HashSet<_>>().len() != input.server_ids.len()
-    {
-        return error("节点列表无效", 400);
-    }
-    let visible_ids = db::visible_server_ids(&ctx.database, &input.server_ids).await?;
-    live::wake_agents(&ctx.env, &visible_ids).await?;
-    no_content()
-}
-
-async fn history(req: &Request, ctx: &RouteContext) -> Result<Response> {
-    if let Some(denied) = public_access_denied(ctx) {
-        return denied;
-    }
-    let path = req.path();
-    let Some(id) = server_id(&path, "/api/history/") else {
-        return error("节点 ID 无效", 400);
-    };
-    if db::get_server(&ctx.database, &id, false).await?.is_none() {
-        return error("节点不存在", 404);
-    }
-    let hours = requested_hours(req, 24 * 30)?;
-    let cache_key = if ctx.settings.public_dashboard {
-        Some(history_cache_key(
-            &req.url()?,
-            "metrics",
-            &id,
-            hours,
-            ctx.settings.history_cache_version,
-        ))
-    } else {
-        None
-    };
-    if let Some(cache_key) = cache_key.as_deref() {
-        if let Some(response) = cached_history_response(cache_key).await {
-            return Ok(response);
-        }
-    }
-    let points = db::history(&ctx.database, &id, hours).await?;
-    let mut response = json(&serde_json::json!({ "points": points }), 200)?;
-    if let Some(cache_key) = cache_key.as_deref() {
-        store_history_response(cache_key, &mut response, history_cache_seconds(hours)).await;
-    }
-    Ok(response)
-}
-
-async fn latency(req: &Request, ctx: &RouteContext) -> Result<Response> {
-    if let Some(denied) = public_access_denied(ctx) {
-        return denied;
-    }
-    let path = req.path();
-    let Some(id) = server_id(&path, "/api/latency/") else {
-        return error("节点 ID 无效", 400);
-    };
-    if db::get_server(&ctx.database, &id, false).await?.is_none() {
-        return error("节点不存在", 404);
-    }
-    let hours = requested_hours(req, 24 * db::MAX_HISTORY_RETENTION_DAYS)?;
-    let cache_key = if ctx.settings.public_dashboard {
-        Some(history_cache_key(
-            &req.url()?,
-            "latency",
-            &id,
-            hours,
-            ctx.settings.history_cache_version,
-        ))
-    } else {
-        None
-    };
-    if let Some(cache_key) = cache_key.as_deref() {
-        if let Some(response) = cached_history_response(cache_key).await {
-            return Ok(response);
-        }
-    }
-    let tasks = latency::tasks_for_server(&ctx.database, &id).await?;
-    let points = latency::history(&ctx.database, &id, hours).await?;
-    let mut response = json(
-        &serde_json::json!({ "tasks": tasks, "points": points }),
-        200,
-    )?;
-    if let Some(cache_key) = cache_key.as_deref() {
-        store_history_response(cache_key, &mut response, history_cache_seconds(hours)).await;
-    }
-    Ok(response)
-}
diff --git a/src/routes/site.rs b/src/routes/site.rs
deleted file mode 100644
index 95a8e90..0000000
--- a/src/routes/site.rs
+++ /dev/null
@@ -1,81 +0,0 @@
-use worker::{Method, Request, Response, Result};
-
-use crate::auth::verify_theme_preview_proof;
-use crate::routes::{RouteContext, RouteOutcome};
-use crate::{
-    db, remote_theme_preview_response, remote_theme_response, secure_public_response, theme,
-    ADMIN_HTML, ADMIN_SCRIPT, ADMIN_STYLE,
-};
-
-/// 管理端内嵌资源（编译进 wasm，不受主题影响）。
-pub(crate) fn embedded_asset(path: &str) -> Result<Option<Response>> {
-    match path {
-        "/admin" | "/admin/" | "/admin/index.html" => {
-            crate::embedded_admin_response(ADMIN_HTML, "text/html; charset=utf-8").map(Some)
-        }
-        "/admin-assets/admin.js" => {
-            crate::embedded_admin_response(ADMIN_SCRIPT, "application/javascript; charset=utf-8")
-                .map(Some)
-        }
-        "/admin-assets/admin.css" => {
-            crate::embedded_admin_response(ADMIN_STYLE, "text/css; charset=utf-8").map(Some)
-        }
-        _ => Ok(None),
-    }
-}
-
-/// 主题预览与远程主题内容；未匹配时归还请求，由调用方落到静态资源。
-pub(crate) async fn route(req: Request, ctx: &RouteContext) -> Result<RouteOutcome> {
-    if req.method() != Method::Get {
-        return Ok(RouteOutcome::Unmatched(req));
-    }
-    let path = req.path();
-
-    if let Some(preview_path) = path.strip_prefix("/__theme-preview/") {
-        let (proof, relative) = preview_path.split_once('/').unwrap_or((preview_path, ""));
-        let Some(theme_id) =
-            verify_theme_preview_proof(proof, &ctx.env, &ctx.settings.admin_password_hash)
-        else {
-            return Ok(RouteOutcome::Handled(secure_public_response(
-                Response::error("主题预览链接已过期", 403)?,
-            )?));
-        };
-        let Some(url) = db::theme_url(&ctx.database, &theme_id).await? else {
-            return Ok(RouteOutcome::Handled(secure_public_response(
-                Response::error("主题不存在", 404)?,
-            )?));
-        };
-        let prefix = format!("/__theme-preview/{proof}");
-        return Ok(RouteOutcome::Handled(
-            remote_theme_preview_response(relative, &url, &prefix).await?,
-        ));
-    }
-
-    if let Some(relative) = path.strip_prefix("/__theme-active/") {
-        if ctx.settings.active_theme_id == theme::BUILTIN_THEME_ID {
-            return Ok(RouteOutcome::Handled(Response::error(
-                "远程主题未启用",
-                404,
-            )?));
-        }
-        let Some(url) = db::theme_url(&ctx.database, &ctx.settings.active_theme_id).await? else {
-            return Ok(RouteOutcome::Handled(Response::error("主题不存在", 404)?));
-        };
-        let remote_path = format!("/{relative}");
-        return Ok(RouteOutcome::Handled(
-            remote_theme_response(&remote_path, &url)
-                .await?
-                .unwrap_or(Response::error("主题资源不存在", 404)?),
-        ));
-    }
-
-    if ctx.settings.active_theme_id != theme::BUILTIN_THEME_ID {
-        if let Some(url) = db::theme_url(&ctx.database, &ctx.settings.active_theme_id).await? {
-            if let Some(response) = remote_theme_response(&path, &url).await? {
-                return Ok(RouteOutcome::Handled(response));
-            }
-        }
-    }
-
-    Ok(RouteOutcome::Unmatched(req))
-}
diff --git a/src/theme.rs b/src/theme.rs
deleted file mode 100644
index 93159b9..0000000
--- a/src/theme.rs
+++ /dev/null
@@ -1,447 +0,0 @@
-use std::time::Duration;
-
-use serde_json::Value;
-use worker::{Error, Method, Request, Result, Url};
-
-use crate::outbound::{fetch_with_timeout, read_response_limited};
-
-pub const BUILTIN_THEME_ID: &str = "builtin-nodeflare-glass";
-pub const BUILTIN_THEME_NAME: &str = "NodeFlare Glass";
-pub const INDEX_MAX_BYTES: usize = 4 * 1024 * 1024;
-pub const ASSET_MAX_BYTES: usize = 16 * 1024 * 1024;
-const SETTINGS_MAX_BYTES: usize = 64 * 1024;
-const REMOTE_FETCH_TIMEOUT: Duration = Duration::from_secs(10);
-
-pub struct ResolvedTheme {
-    pub source_url: String,
-    pub resolved_url: String,
-}
-
-pub fn normalize_url(value: &str) -> Option<String> {
-    let raw = value.trim();
-    if !(12..=2048).contains(&raw.len()) || raw.contains('\\') {
-        return None;
-    }
-    let parsed = Url::parse(raw).ok()?;
-    if parsed.scheme() != "https"
-        || parsed.host_str() != Some("github.com")
-        || parsed.port().is_some()
-        || parsed.username() != ""
-        || parsed.password().is_some()
-        || parsed.query().is_some()
-        || parsed.fragment().is_some()
-    {
-        return None;
-    }
-
-    let path = parsed.path().trim_matches('/');
-    let mut parts: Vec<&str> = path.split('/').filter(|part| !part.is_empty()).collect();
-    if parts.len() == 2 {
-        // 纯仓库地址默认使用 main 分支。
-        parts.push("tree");
-        parts.push("main");
-    }
-    if parts.len() < 4
-        || parts[2] != "tree"
-        || parts.iter().any(|part| {
-            part.is_empty()
-                || !part
-                    .chars()
-                    .all(|character| character.is_ascii_alphanumeric() || ".-_".contains(character))
-                || matches!(*part, "." | "..")
-        })
-    {
-        return None;
-    }
-    Some(format!("https://github.com/{}", parts.join("/")))
-}
-
-pub fn resolve_url(value: &str) -> Result<ResolvedTheme> {
-    let source_url =
-        normalize_url(value).ok_or_else(|| Error::RustError("主题 URL 格式无效".to_string()))?;
-    let parsed = Url::parse(&source_url)?;
-
-    let parts: Vec<_> = parsed
-        .path()
-        .trim_matches('/')
-        .split('/')
-        .filter(|part| !part.is_empty())
-        .collect();
-    let owner = parts[0];
-    let repository = parts[1];
-    let reference = parts[3];
-    let subdirectory = parts[4..].join("/");
-    let suffix = if subdirectory.is_empty() {
-        String::new()
-    } else {
-        format!("/{subdirectory}")
-    };
-    Ok(ResolvedTheme {
-        source_url,
-        resolved_url: format!(
-            "https://raw.githubusercontent.com/{owner}/{repository}/{reference}{suffix}"
-        ),
-    })
-}
-
-fn remote_url(base: &str, relative: &str) -> String {
-    format!("{}/{}", base.trim_end_matches('/'), relative)
-}
-
-fn raw_github_base(base: &str) -> Option<Url> {
-    let parsed = Url::parse(&format!("{}/", base.trim_end_matches('/'))).ok()?;
-    if parsed.scheme() != "https"
-        || parsed.host_str() != Some("raw.githubusercontent.com")
-        || parsed.port().is_some()
-        || parsed.username() != ""
-        || parsed.password().is_some()
-        || parsed.query().is_some()
-        || parsed.fragment().is_some()
-    {
-        return None;
-    }
-    let parts = parsed
-        .path()
-        .trim_matches('/')
-        .split('/')
-        .filter(|part| !part.is_empty())
-        .collect::<Vec<_>>();
-    (parts.len() >= 3
-        && parts.iter().all(|part| {
-            !matches!(*part, "." | "..")
-                && part
-                    .chars()
-                    .all(|character| character.is_ascii_alphanumeric() || ".-_".contains(character))
-        }))
-    .then_some(parsed)
-}
-
-pub fn asset_url(base: &str, path: &str) -> Option<String> {
-    let relative = path.strip_prefix("/assets/")?;
-    if relative.is_empty()
-        || relative.len() > 1024
-        || relative
-            .chars()
-            .any(|character| character.is_control() || matches!(character, '%' | '\\' | '?' | '#'))
-        || relative
-            .split('/')
-            .any(|part| part.is_empty() || part == "." || part == "..")
-    {
-        return None;
-    }
-
-    let base = raw_github_base(base)?;
-    let remote = base.join(&format!("assets/{relative}")).ok()?;
-    let expected_path = format!("{}assets/{relative}", base.path());
-    if remote.origin() != base.origin() || remote.path() != expected_path {
-        return None;
-    }
-    Some(remote.to_string())
-}
-
-pub fn index_url(base: &str) -> Option<String> {
-    raw_github_base(base).map(|base| remote_url(base.as_str(), "index.html"))
-}
-
-fn settings_url(base: &str) -> Option<String> {
-    raw_github_base(base).map(|base| remote_url(base.as_str(), "theme.json"))
-}
-
-pub async fn validate_remote(base: &str) -> Result<()> {
-    let index = index_url(base)
-        .ok_or_else(|| Error::RustError("主题资源地址不是 GitHub Raw 地址".to_string()))?;
-    let request = Request::new(&index, Method::Get)?;
-    let Some(mut response) = fetch_with_timeout(request, REMOTE_FETCH_TIMEOUT).await? else {
-        return Err(Error::RustError("主题 index.html 请求超时".to_string()));
-    };
-    let status = response.status_code();
-    if !(200..300).contains(&status) {
-        return Err(Error::RustError(format!(
-            "主题 index.html 返回 HTTP {status}"
-        )));
-    }
-    let body = read_response_limited(&mut response, INDEX_MAX_BYTES)
-        .await?
-        .ok_or_else(|| Error::RustError("主题 index.html 内容无效".to_string()))?;
-    let body = String::from_utf8(body)
-        .map_err(|_| Error::RustError("主题 index.html 不是 UTF-8 文本".to_string()))?;
-    if body.trim().is_empty() {
-        return Err(Error::RustError("主题 index.html 内容无效".to_string()));
-    }
-    Ok(())
-}
-
-pub fn builtin_settings_schema() -> Value {
-    let currencies = [
-        "CNY", "USD", "HKD", "EUR", "GBP", "JPY", "RUB", "CHF", "INR", "VND", "THB", "CAD",
-    ];
-    serde_json::json!({
-        "schema": 1,
-        "source": "builtin",
-        "settings": [
-            {
-                "key": "assetCurrency",
-                "label": "资产折算币种",
-                "type": "select",
-                "default": "CNY",
-                "options": currencies.iter().map(|currency| {
-                    serde_json::json!({ "label": currency, "value": currency })
-                }).collect::<Vec<_>>()
-            },
-            {
-                "key": "enableBlur",
-                "label": "启用毛玻璃效果",
-                "type": "toggle",
-                "default": true
-            },
-            {
-                "key": "showOnline",
-                "label": "总览显示在线节点",
-                "type": "toggle",
-                "default": true
-            },
-            {
-                "key": "showCarrierLatency",
-                "label": "节点卡片分线路显示延迟",
-                "type": "toggle",
-                "default": false
-            },
-            {
-                "key": "telecomLatencyTask",
-                "label": "电信线路任务名称",
-                "type": "text",
-                "default": "",
-                "placeholder": "留空时按任务名称自动匹配"
-            },
-            {
-                "key": "mobileLatencyTask",
-                "label": "移动线路任务名称",
-                "type": "text",
-                "default": "",
-                "placeholder": "留空时按任务名称自动匹配"
-            },
-            {
-                "key": "unicomLatencyTask",
-                "label": "联通线路任务名称",
-                "type": "text",
-                "default": "",
-                "placeholder": "留空时按任务名称自动匹配"
-            }
-        ]
-    })
-}
-
-fn empty_settings_schema(source: &str) -> Value {
-    serde_json::json!({ "schema": 1, "source": source, "settings": [] })
-}
-
-fn valid_setting_value(value: &Value) -> bool {
-    value.is_string() || value.is_boolean() || value.as_f64().is_some()
-}
-
-fn validate_settings_schema(value: Value) -> Option<Value> {
-    let object = value.as_object()?;
-    if object.get("schema")?.as_u64()? != 1 {
-        return None;
-    }
-    let fields = object.get("settings")?.as_array()?;
-    if fields.len() > 40 {
-        return None;
-    }
-    let allowed_types = [
-        "text", "textarea", "url", "color", "select", "toggle", "number",
-    ];
-    let mut keys = std::collections::HashSet::new();
-    for field in fields {
-        let field = field.as_object()?;
-        let key = field.get("key")?.as_str()?;
-        let label = field.get("label")?.as_str()?;
-        let field_type = field.get("type")?.as_str()?;
-        if key.is_empty()
-            || key.len() > 64
-            || !key
-                .chars()
-                .all(|character| character.is_ascii_alphanumeric() || "_-".contains(character))
-            || !keys.insert(key)
-            || label.is_empty()
-            || label.chars().count() > 80
-            || !allowed_types.contains(&field_type)
-            || field.keys().any(|key| {
-                !matches!(
-                    key.as_str(),
-                    "key"
-                        | "label"
-                        | "type"
-                        | "default"
-                        | "placeholder"
-                        | "options"
-                        | "min"
-                        | "max"
-                        | "step"
-                )
-            })
-            || field
-                .get("default")
-                .is_some_and(|value| !valid_setting_value(value))
-            || field
-                .get("placeholder")
-                .is_some_and(|value| value.as_str().is_none_or(|text| text.chars().count() > 160))
-            || ["min", "max", "step"].iter().any(|key| {
-                field
-                    .get(*key)
-                    .is_some_and(|value| value.as_f64().is_none())
-            })
-        {
-            return None;
-        }
-        let options = field.get("options").and_then(Value::as_array);
-        if field_type == "select"
-            && options.is_none_or(|choices| {
-                choices.is_empty()
-                    || choices.len() > 64
-                    || choices.iter().any(|choice| {
-                        choice.as_object().is_none_or(|choice| {
-                            choice.len() != 2
-                                || choice
-                                    .get("label")
-                                    .and_then(Value::as_str)
-                                    .is_none_or(|text| text.is_empty() || text.chars().count() > 80)
-                                || choice
-                                    .get("value")
-                                    .and_then(Value::as_str)
-                                    .is_none_or(|text| {
-                                        text.is_empty() || text.chars().count() > 160
-                                    })
-                        })
-                    })
-            })
-        {
-            return None;
-        }
-    }
-    Some(serde_json::json!({
-        "schema": 1,
-        "source": "remote",
-        "settings": fields
-    }))
-}
-
-pub async fn remote_settings_schema(base: &str) -> Result<Value> {
-    let url = settings_url(base)
-        .ok_or_else(|| Error::RustError("主题资源地址不是 GitHub Raw 地址".to_string()))?;
-    let request = Request::new(&url, Method::Get)?;
-    let Some(mut response) = fetch_with_timeout(request, REMOTE_FETCH_TIMEOUT).await? else {
-        return Err(Error::RustError("主题 theme.json 请求超时".to_string()));
-    };
-    if response.status_code() == 404 {
-        return Ok(empty_settings_schema("remote"));
-    }
-    if !(200..300).contains(&response.status_code()) {
-        return Err(Error::RustError(format!(
-            "主题 theme.json 返回 HTTP {}",
-            response.status_code()
-        )));
-    }
-    let body = read_response_limited(&mut response, SETTINGS_MAX_BYTES)
-        .await?
-        .ok_or_else(|| Error::RustError("主题 theme.json 内容无效".to_string()))?;
-    let value = serde_json::from_slice(body.as_slice())
-        .map_err(|_| Error::RustError("主题 theme.json 不是有效 JSON".to_string()))?;
-    validate_settings_schema(value)
-        .ok_or_else(|| Error::RustError("主题 theme.json 设置格式无效".to_string()))
-}
-
-/// 读取远程主题 theme.json 中的 version 字段；无 theme.json 或无版本时返回 None。
-pub async fn remote_theme_version(base: &str) -> Option<String> {
-    let url = settings_url(base)?;
-    let request = Request::new(&url, Method::Get).ok()?;
-    let mut response = fetch_with_timeout(request, REMOTE_FETCH_TIMEOUT)
-        .await
-        .ok()??;
-    if !(200..300).contains(&response.status_code()) {
-        return None;
-    }
-    let body = read_response_limited(&mut response, SETTINGS_MAX_BYTES)
-        .await
-        .ok()??;
-    let value: Value = serde_json::from_slice(body.as_slice()).ok()?;
-    let version = value.get("version")?.as_str()?.trim();
-    if version.is_empty()
-        || version.len() > 40
-        || !version
-            .chars()
-            .all(|character| character.is_ascii_alphanumeric() || ".-_+ ".contains(character))
-    {
-        return None;
-    }
-    Some(version.to_string())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::{asset_url, normalize_url, resolve_url, validate_settings_schema};
-
-    #[test]
-    fn validates_remote_theme_settings() {
-        let schema = validate_settings_schema(serde_json::json!({
-            "schema": 1,
-            "settings": [{
-                "key": "accent",
-                "label": "强调色",
-                "type": "color",
-                "default": "#00aaff"
-            }]
-        }))
-        .expect("valid schema");
-        assert_eq!(schema["source"], "remote");
-        assert!(validate_settings_schema(serde_json::json!({
-            "schema": 1,
-            "settings": [{ "key": "../bad", "label": "Bad", "type": "text" }]
-        }))
-        .is_none());
-        assert!(validate_settings_schema(serde_json::json!({
-            "schema": 1,
-            "settings": [{ "key": "mode", "label": "Mode", "type": "select" }]
-        }))
-        .is_none());
-    }
-
-    #[test]
-    fn accepts_only_github_urls() {
-        assert_eq!(
-            normalize_url("https://github.com/acme/theme/tree/abc123").as_deref(),
-            Some("https://github.com/acme/theme/tree/abc123")
-        );
-        assert!(normalize_url("https://themes.example.com/nodeflare").is_none());
-        assert!(normalize_url("http://themes.example.com/theme").is_none());
-        assert!(normalize_url("https://user@example.com/theme").is_none());
-        assert_eq!(
-            normalize_url("https://github.com/acme/theme").as_deref(),
-            Some("https://github.com/acme/theme/tree/main")
-        );
-        assert_eq!(
-            resolve_url("https://github.com/acme/theme/tree/main/dist")
-                .expect("GitHub theme URL")
-                .resolved_url,
-            "https://raw.githubusercontent.com/acme/theme/main/dist"
-        );
-    }
-
-    #[test]
-    fn limits_proxy_paths_to_theme_assets() {
-        assert_eq!(
-            asset_url(
-                "https://raw.githubusercontent.com/acme/theme/main",
-                "/assets/app.js"
-            )
-            .as_deref(),
-            Some("https://raw.githubusercontent.com/acme/theme/main/assets/app.js")
-        );
-        assert!(asset_url("https://example.com/theme", "/assets/app.js").is_none());
-        assert!(asset_url("https://example.com/theme", "/logo.svg").is_none());
-        assert!(asset_url("https://example.com/theme", "/assets/../secret").is_none());
-        assert!(asset_url("https://example.com/theme", "/assets/%2e%2e/secret").is_none());
-        assert!(asset_url("https://example.com/theme", "/assets/..\\secret").is_none());
-        assert!(asset_url("https://example.com/theme", "/assets/a%2fb.js").is_none());
-    }
-}
diff --git a/src/turnstile.rs b/src/turnstile.rs
deleted file mode 100644
index af8a1d6..0000000
--- a/src/turnstile.rs
+++ /dev/null
@@ -1,127 +0,0 @@
-use std::time::Duration;
-
-use serde::{Deserialize, Serialize};
-use worker::{wasm_bindgen::JsValue, Headers, Method, Request, RequestInit, Result};
-
-use crate::outbound::{fetch_with_timeout, read_json_limited};
-
-const SITEVERIFY_URL: &str = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
-const VERIFY_TIMEOUT_SECONDS: u64 = 8;
-const VERIFY_RESPONSE_MAX_BYTES: usize = 64 * 1024;
-pub const ADMIN_LOGIN_ACTION: &str = "admin-login";
-pub const PUBLIC_DASHBOARD_ACTION: &str = "public-dashboard";
-
-#[derive(Serialize)]
-struct VerifyRequest<'a> {
-    secret: &'a str,
-    response: &'a str,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    remoteip: Option<&'a str>,
-}
-
-#[derive(Debug, Deserialize)]
-struct VerifyResponse {
-    success: bool,
-    hostname: Option<String>,
-    action: Option<String>,
-}
-
-fn matches_request(
-    response: &VerifyResponse,
-    expected_hostname: &str,
-    expected_action: &str,
-) -> bool {
-    response.success
-        && response
-            .hostname
-            .as_deref()
-            .is_some_and(|hostname| hostname.eq_ignore_ascii_case(expected_hostname))
-        && response.action.as_deref() == Some(expected_action)
-}
-
-pub async fn verify(
-    token: &str,
-    secret: &str,
-    remote_ip: Option<&str>,
-    expected_hostname: &str,
-    expected_action: &str,
-) -> Result<bool> {
-    if token.is_empty()
-        || token.len() > 2048
-        || secret.is_empty()
-        || expected_hostname.is_empty()
-        || expected_action.is_empty()
-    {
-        return Ok(false);
-    }
-
-    let body = serde_json::to_string(&VerifyRequest {
-        secret,
-        response: token,
-        remoteip: remote_ip,
-    })?;
-    let headers = Headers::new();
-    headers.set("Content-Type", "application/json")?;
-    let mut init = RequestInit::new();
-    init.with_method(Method::Post)
-        .with_headers(headers)
-        .with_body(Some(JsValue::from_str(&body)));
-    let request = Request::new_with_init(SITEVERIFY_URL, &init)?;
-
-    let Some(mut response) =
-        fetch_with_timeout(request, Duration::from_secs(VERIFY_TIMEOUT_SECONDS)).await?
-    else {
-        return Ok(false);
-    };
-    if !(200..300).contains(&response.status_code()) {
-        return Ok(false);
-    }
-    let result: VerifyResponse =
-        read_json_limited(&mut response, VERIFY_RESPONSE_MAX_BYTES).await?;
-    Ok(matches_request(&result, expected_hostname, expected_action))
-}
-
-#[cfg(test)]
-mod tests {
-    use super::{matches_request, VerifyResponse};
-
-    fn response(hostname: &str, action: &str) -> VerifyResponse {
-        VerifyResponse {
-            success: true,
-            hostname: Some(hostname.to_string()),
-            action: Some(action.to_string()),
-        }
-    }
-
-    #[test]
-    fn accepts_matching_hostname_and_action() {
-        assert!(matches_request(
-            &response("status.example.com", "admin-login"),
-            "STATUS.EXAMPLE.COM",
-            "admin-login",
-        ));
-    }
-
-    #[test]
-    fn rejects_mismatched_or_incomplete_context() {
-        assert!(!matches_request(
-            &response("other.example.com", "admin-login"),
-            "status.example.com",
-            "admin-login",
-        ));
-        assert!(!matches_request(
-            &response("status.example.com", "public-dashboard"),
-            "status.example.com",
-            "admin-login",
-        ));
-        assert!(!matches_request(
-            &VerifyResponse {
-                success: true,
-                hostname: None,
-                action: None,
-            },
-            "status.example.com",
-            "admin-login",
-        ));
-    }
-}
diff --git a/start.sh b/start.sh
new file mode 100755
index 0000000..faca164
--- /dev/null
+++ b/start.sh
@@ -0,0 +1,21 @@
+#!/bin/sh
+set -eu
+
+root_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+cd "$root_dir"
+
+if [ ! -f backend/config.toml ]; then
+  echo "配置文件不存在，从示例复制..."
+  cp backend/config.example.toml backend/config.toml
+  echo "请编辑 backend/config.toml（尤其是 admin_password）后重新运行"
+  exit 1
+fi
+
+echo "构建前端..."
+sh scripts/build-frontend.sh
+
+echo "构建后端..."
+sh scripts/build-backend.sh
+
+echo "启动后端..."
+exec backend/target/release/nodeflare-backend --config backend/config.toml
diff --git a/wrangler.jsonc b/wrangler.jsonc
deleted file mode 100644
index e92100d..0000000
--- a/wrangler.jsonc
+++ /dev/null
@@ -1,78 +0,0 @@
-{
-  "$schema": "./node_modules/wrangler/config-schema.json",
-  "name": "nodeflare",
-  "main": "build/index.js",
-  "compatibility_date": "2026-08-18",
-  "keep_vars": true,
-  "workers_dev": true,
-  "preview_urls": false,
-  "build": {
-    "command": "sh scripts/build-worker.sh"
-  },
-  "assets": {
-    "directory": "./frontend/dist",
-    "binding": "ASSETS",
-    "not_found_handling": "single-page-application",
-    "run_worker_first": [
-      "/",
-      "/index.html",
-      "/instance/*",
-      "/api/*",
-      "/admin",
-      "/admin/*",
-      "/admin-assets/*",
-      "/__scheduled",
-      "/__theme-active/*",
-      "/__theme-preview/*"
-    ]
-  },
-  "d1_databases": [
-    {
-      "binding": "DB",
-      "database_name": "nodeflare",
-      "migrations_dir": "migrations",
-      "migrations_pattern": "migrations/initial_*.sql"
-    }
-  ],
-  "ratelimits": [
-    {
-      "name": "API_RATE_LIMITER",
-      "namespace_id": "73120401",
-      "simple": { "limit": 300, "period": 60 }
-    },
-    {
-      "name": "AUTH_RATE_LIMITER",
-      "namespace_id": "73120402",
-      "simple": { "limit": 20, "period": 60 }
-    },
-    {
-      "name": "AGENT_RATE_LIMITER",
-      "namespace_id": "73120403",
-      "simple": { "limit": 120, "period": 60 }
-    }
-  ],
-  "durable_objects": {
-    "bindings": [
-      { "name": "LIVE_HUB", "class_name": "LiveHub" }
-    ]
-  },
-  "migrations": [
-    { "tag": "v1", "new_sqlite_classes": ["LiveHub"] }
-  ],
-  "triggers": {
-    "crons": ["*/5 * * * *"]
-  },
-  "observability": {
-    "enabled": false,
-    "logs": {
-      "enabled": false,
-      "invocation_logs": false
-    },
-    "traces": {
-      "enabled": false
-    }
-  },
-  "dev": {
-    "port": 8787
-  }
-}