fix(security): console and account checks now survive a Livewire action

Livewire re-applies only the middleware on its persistent list when an action
posts to /livewire/update. Its defaults cover auth; ours were not on the list —
only RestrictAdminHost had been added. So EnsureAdmin and EnsureCustomerActive
guarded the PAGE and not the actions, and the page is not where the actions run:
a signed-in non-operator who could reach the admin host could drive console
components, and a suspended customer could keep driving the portal.

Found by Codex while reviewing the domain-separation design, and confirmed
against Livewire's own default list in vendor.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.env.example

@@ -63,23 +63,142 @@ REVERB_SERVER_PORT=8080
 # browser-side (baked into built assets): the address a browser can reach
 VITE_REVERB_APP_KEY=change-me-app-key
 VITE_REVERB_HOST=localhost
-VITE_REVERB_PORT=8080
-VITE_REVERB_SCHEME=http
+VITE_REVERB_PORT=443
+VITE_REVERB_SCHEME=https
 VITE_APP_NAME=CluPilot
 
 # Vite HMR host the browser connects to (dev). Set to the reachable VM address
 # when developing against a remote host; localhost for local-only.
 VITE_HMR_HOST=localhost
 
-# ── Mail (dev → log) ─────────────────────────────────────────────────────
+# ── Mail ─────────────────────────────────────────────────────────────────
+# DEV: `log` writes mails to storage/logs (nothing is sent).
+# PROD: switch to smtp and fill in the credentials below.
 MAIL_MAILER=log
 MAIL_FROM_ADDRESS=hello@clupilot.local
 MAIL_FROM_NAME=CluPilot
+# MAIL_MAILER=smtp
+# MAIL_HOST=smtp.your-provider.tld
+# MAIL_PORT=587
+# MAIL_USERNAME=
+# MAIL_PASSWORD=
+# MAIL_SCHEME=tls           # tls | smtps (465)
+
+# ═════════════════════════════════════════════════════════════════════════
+#  CluPilot operations — fill these in to run real provisioning.
+#  Everything below is OPTIONAL for local dev: left blank, the services are
+#  no-ops/fakes and the app + test suite still run. Only real infrastructure
+#  work (host onboarding, customer provisioning) needs them.
+# ═════════════════════════════════════════════════════════════════════════
+
+# ── Stripe (payments) ────────────────────────────────────────────────────
+# WEBHOOK_SECRET is READ BY CODE today (signature check on /webhooks/stripe).
+# Outside local/testing a missing secret makes the webhook fail closed.
+STRIPE_WEBHOOK_SECRET=
+# Not read yet — needed once the Checkout flow is built (currently the portal
+# only records a purchase intent):
+STRIPE_KEY=
+STRIPE_SECRET=
+
+# ── DNS (Hetzner DNS API) ────────────────────────────────────────────────
+# Creates <subdomain>.<zone> A-records for each customer instance.
+HETZNER_DNS_TOKEN=
+CLUPILOT_DNS_ZONE=clupilot.com
+
+# ── Traefik (reverse proxy + TLS) ────────────────────────────────────────
+# Directory ON THE PROXMOX HOST where CluPilot writes dynamic route files.
+TRAEFIK_DYNAMIC_PATH=/etc/traefik/dynamic
+
+# ── WireGuard hub (this CluPilot VM) ─────────────────────────────────────
+# Hosts join this hub during onboarding; CluPilot reaches them over the tunnel.
+CLUPILOT_WG_SUBNET=10.66.0.0/24
+CLUPILOT_WG_HUB_IP=10.66.0.1
+CLUPILOT_WG_ENDPOINT=              # public host:port peers dial, e.g. vpn.clupilot.com:51820
+CLUPILOT_WG_HUB_PUBKEY=            # `wg pubkey < /etc/wireguard/privatekey`
+CLUPILOT_WG_CONFIG_PATH=/etc/wireguard/wg0.conf
+
+# ── SSH identity for host onboarding ─────────────────────────────────────
+# Deployed to each fresh server after the one-time root password login.
+# PREFERRED: point at files (a multi-line PEM cannot live in .env).
+#   ssh-keygen -t ed25519 -N '' -C clupilot -f storage/app/ssh/clupilot
+CLUPILOT_SSH_PUBLIC_KEY_PATH=
+CLUPILOT_SSH_PRIVATE_KEY_PATH=
+# Alternative (single-line values only):
+CLUPILOT_SSH_PUBLIC_KEY=
+CLUPILOT_SSH_PRIVATE_KEY=
+CLUPILOT_SSH_COMMAND_TIMEOUT=2000
+
+# ── Monitoring ───────────────────────────────────────────────────────────
+# The built-in client speaks a GENERIC REST API:
+#   GET/POST /monitors, GET/DELETE /monitors/{id}
+# For Uptime Kuma use the bundled bridge below (Kuma's own REST API is
+# read-only — monitor CRUD goes through Socket.IO):
+#   MONITORING_API_URL=http://kuma-bridge:8080
+# Leave blank to disable monitoring entirely: provisioning records a stable
+# breadcrumb and its own health checks (occ status, TLS, admin user) still
+# gate acceptance.
+MONITORING_API_URL=
+MONITORING_API_TOKEN=
+
+# ── Uptime Kuma (über die mitgelieferte Bridge) ───────────────────────────
+# Kuma kann Monitore nur über Socket.IO anlegen, daher die Bridge:
+#   docker compose --profile monitoring up -d --build kuma-bridge
+# Danach hier MONITORING_API_URL auf die Bridge zeigen lassen:
+#   MONITORING_API_URL=http://kuma-bridge:8080
+# MONITORING_API_TOKEN ist gleichzeitig das Bridge-Token (frei wählbar, lang).
+KUMA_URL=
+KUMA_USERNAME=
+KUMA_PASSWORD=
+KUMA_TOTP=
+
+# Monitoring-Verhalten bei Ausfall:
+#   MONITORING_REQUIRED=false -> Bereitstellung läuft weiter (Warn-Event), Standard
+#   MONITORING_REQUIRED=true  -> Lauf schlägt fehl, wenn Monitoring nicht erreichbar
+MONITORING_REQUIRED=false
+MONITORING_ATTEMPTS=2
+
+# ── Admin-Konsole: erlaubte Hostnamen ────────────────────────────────────
+# Die Proxmox-Hosts UND das Admin-Dashboard dürfen nie öffentlich erreichbar
+# sein. Primär regelt das dein Reverse Proxy (nur www/app/ws/api öffentlich);
+# dies ist die zweite Verteidigungslinie IN der App: auf jedem anderen Host
+# antwortet /admin mit 404 (nicht 403 — verrät nicht, dass es die Konsole gibt).
+# Komma-getrennt. LEER = keine Einschränkung (aktueller Dev-Stand).
+# Beispiel: # Schluessel fuer gespeicherte VPN-Konfigurationen (32 Byte, base64).
+# Bewusst getrennt von APP_KEY. Leer = Speichern deaktiviert.
+# Erzeugen: head -c 32 /dev/urandom | base64
+VPN_CONFIG_KEY=
+
+# Netze, die als "wir" gelten, solange die Website versteckt ist
+# (WireGuard-Subnetz). Alles andere sieht die Platzhalterseite.
+TRUSTED_RANGES=10.66.0.0/24,127.0.0.1
+
+# Umsatzsteuersatz des Verkäufers in Prozent. Preise in der Konfiguration
+# sind NETTO; die Oberfläche weist beides aus.
+CLUPILOT_TAX_PERCENT=20
+
+ADMIN_HOSTS=admin.dev.clupilot.com,10.10.90.185,localhost,127.0.0.1
+
+# ── Nextcloud blueprint template ─────────────────────────────────────────
+# NOT an env var: set the Proxmox template VMID per plan in
+# config/provisioning.php → plans.*.template_vmid (default 9000).
 
 # ── docker-compose knobs (host-side) ─────────────────────────────────────
 HOST_UID=1000
 HOST_GID=1000
 APP_PORT=80
+# Vite dev server (HMR). Off by default: over the HTTPS domains the
+# browser cannot load assets from http://<ip>:5173. Set true only when
+# working over http://10.10.90.185, then run: docker compose up -d app
+VITE_AUTOSTART=false
 VITE_PORT=5173
 REVERB_HOST_PORT=8080
 DB_HOST_PORT=3306
+
+# ── CI (Gitea Actions) ──────────────────────────────────────────────────────
+# Registrierungs-Token aus Gitea: Repo → Settings → Actions → Runners →
+# "Create new runner". Danach:  docker compose --profile ci up -d runner
+GITEA_INSTANCE_URL=https://git.bave.dev
+GITEA_RUNNER_TOKEN=
+GITEA_RUNNER_NAME=clupilot-local
+# Passend zur Server-Version halten (1.20 verträgt keinen aktuellen Runner).
+GITEA_RUNNER_VERSION=0.2.6

.gitea/workflows/tests.yml

@@ -0,0 +1,118 @@
+# CluPilot CI — runs on Gitea Actions (GitHub-Actions syntax, own runner).
+#
+# Deliberately not mirrored to GitHub: this repository describes how our
+# infrastructure is provisioned, and the same workflow runs at home. If we ever
+# move, this file goes along unchanged.
+name: tests
+
+on:
+  push:
+    branches: [main, 'feat/**']
+  pull_request:
+
+jobs:
+  pest:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4.2.2
+
+      - name: Set up PHP
+        # Pinned: the floating v2 tag now requires node24, which the runner
+        # matching Gitea 1.20 cannot execute. 2.34.1 is the newest that still
+        # declares node20.
+        uses: shivammathur/setup-php@2.34.1
+        with:
+          php-version: '8.4'
+          extensions: mbstring, pdo_sqlite, sodium, redis, bcmath, gd, zip
+          coverage: none
+
+      - name: Install PHP dependencies
+        # Source clones, not dist archives: dist downloads go through GitHub's
+        # API, which throttles anonymous callers and left a half-installed
+        # vendor/ behind — the tests then failed with 500s that had nothing to
+        # do with the code. Cloning is slower and does not need anyone's quota.
+        # Swap back to --prefer-dist once a GitHub token is configured.
+        run: composer install --no-interaction --prefer-source --no-progress
+
+      - name: Prepare environment
+        run: |
+          cp .env.example .env
+          php artisan key:generate
+
+      - name: Tests
+        # phpunit.xml pins its own sqlite/array drivers, so no services needed.
+        run: ./vendor/bin/pest --colors=always
+
+  assets:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4.2.2
+
+      - uses: actions/setup-node@v4.1.0
+        with:
+          node-version: '22'
+
+      - name: Install JS dependencies
+        run: npm ci --no-fund --no-audit
+
+      # A build failure here is what used to surface as "the design is broken"
+      # only after deploying — catch it before it ships.
+      - name: Build assets
+        run: npm run build
+
+  release:
+    # Only a green run produces the tag the console offers as an update.
+    needs: [pest, assets]
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4.2.2
+        with:
+          fetch-depth: 0
+
+      - name: Tag this commit as tested
+        run: |
+          tag="tested-$(date -u +%Y%m%d-%H%M)-$(git rev-parse --short HEAD)"
+          git tag "$tag"
+          git push origin "$tag"
+
+      # A release is cut by editing VERSION and merging it — nothing else. The
+      # tag is created here, only after the suite is green, and only if it does
+      # not already exist. Never moved: servers are pinned to these, and a tag
+      # that changes underneath them means two machines claiming one version.
+      - name: Tag the release when VERSION changed
+        run: |
+          version="$(tr -d ' \n\r' < VERSION)"
+          # Anchored, because a `case` glob does not anchor: `[0-9]*.[0-9]*`
+          # happily accepts 1x.2y.3garbage and would tag it.
+          printf '%s' "$version" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$' \
+            || { echo "VERSION is not MAJOR.MINOR.PATCH: '$version'" >&2; exit 1; }
+
+          # Only the commit that RAISED the version is the release. Without
+          # this, any later green push finds the tag missing and claims it —
+          # and the tag would then name code the bump never described. Runs
+          # overlap and finish out of order; that is enough for it to happen.
+          previous="$(git show 'HEAD^:VERSION' 2>/dev/null | tr -d ' \n\r' || true)"
+          if [ "$previous" = "$version" ]; then
+            echo "::notice::VERSION is unchanged ($version) — nothing to release."
+            exit 0
+          fi
+
+          tag="v${version}"
+          git fetch --tags --force origin
+
+          if existing="$(git rev-parse -q --verify "refs/tags/${tag}^{commit}")"; then
+            # Already released. The invariant is that the tag points at the
+            # commit VERSION was raised in — if a later commit still carries
+            # that number, that is fine, but the tag must not be re-pointed.
+            if [ "$existing" != "$(git rev-parse HEAD)" ]; then
+              echo "::notice::${tag} already exists at ${existing}; leaving it alone."
+            fi
+            exit 0
+          fi
+
+          git config user.name  "CluPilot CI"
+          git config user.email "ci@clupilot.local"
+          git tag -a "$tag" -m "CluPilot ${version}"
+          git push origin "$tag"
+          echo "::notice::Released ${tag}"

.gitignore

@@ -28,3 +28,4 @@ Thumbs.db
 
 # Gitea push token (parent home dir; never track)
 .env.gitea
+clupilot.env

VERSION

@@ -0,0 +1 @@
+1.0.0

app/Actions/ApplyStripeBillingEvent.php

@@ -0,0 +1,459 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\StripePendingEvent;
+use App\Models\Subscription;
+use App\Models\SubscriptionRecord;
+use Illuminate\Database\UniqueConstraintViolationException;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Log;
+
+/**
+ * What Stripe tells us about the billing cycle, applied to the contract.
+ *
+ * The division of labour: Stripe owns the money — retries, dunning, off-session
+ * SCA, invoice numbering — and we own capability, because Stripe does not know
+ * how big the VM should be. So these handlers move period boundaries and status,
+ * and write the register. They never re-derive an amount: the invoice is the
+ * authority for what was charged, and recomputing it here from our own
+ * catalogue would produce a second, disagreeing answer.
+ *
+ * Every handler is idempotent. Stripe retries a webhook until it gets a 2xx,
+ * and it also sends the same event to several endpoints — so "already applied"
+ * is the normal case, not the exception.
+ */
+class ApplyStripeBillingEvent
+{
+    /**
+     * Precedence when two events share a second — highest wins.
+     *
+     * Ordered by how much the event settles: a payment that went through is the
+     * last word, a snapshot of the subscription is a running picture, and a
+     * failed attempt is the least final of the three, since a retry may already
+     * have succeeded.
+     */
+    private const RANK_PAID = 3;
+
+    private const RANK_UPDATED = 2;
+
+    private const RANK_FAILED = 1;
+
+    public function __construct(private RecordCommercialEvent $record) {}
+
+    /**
+     * A renewal was paid. Move the period on and enter it in the register.
+     *
+     * @param  array<string, mixed>  $invoice
+     */
+    public function invoicePaid(array $invoice, ?Carbon $eventAt = null): ?SubscriptionRecord
+    {
+        $subscription = $this->resolve($invoice['subscription'] ?? null);
+
+        if ($subscription === null) {
+            return null;
+        }
+
+        $reason = (string) ($invoice['billing_reason'] ?? '');
+
+        // The checkout's own invoice is not a renewal — it is the purchase, and
+        // OpenSubscription has already entered it. Recording it again here
+        // would double every customer's first payment in the register.
+        if ($reason === 'subscription_create') {
+            return null;
+        }
+
+        // Only a cycle renewal moves the term on. Stripe also sends paid
+        // invoices for prorations and for charges raised by hand, and those are
+        // money received without being the start of a new month — calling them
+        // renewals would push the period forward on a top-up.
+        $isRenewal = $reason === 'subscription_cycle';
+        $invoiceId = (string) ($invoice['id'] ?? '');
+
+        [$start, $end] = $this->period($invoice);
+
+        // A contract that has ended stays ended (mutateInOrder refuses one), so
+        // a final invoice arriving after the deletion cannot hand a departed
+        // customer their service back. The payment is still entered in the
+        // register below; it did happen.
+        if ($isRenewal && $start !== null && $end !== null) {
+            $this->mutateInOrder($subscription, $eventAt, self::RANK_PAID, fn (Subscription $fresh) => $end
+                // Never backwards: a renewal delayed behind the next one would
+                // otherwise shorten the term the customer has already paid for.
+                ->greaterThanOrEqualTo($fresh->current_period_end)
+                    // Period boundaries are not part of the frozen snapshot:
+                    // what the customer is owed does not change, only which
+                    // month it is.
+                    ? [
+                        'current_period_start' => $start,
+                        'current_period_end' => $end,
+                        'status' => 'active',
+                        'stripe_status' => 'active',
+                    ]
+                    : null);
+        }
+
+        // One invoice, one entry — enforced by the unique index rather than by
+        // a check, because Stripe can deliver the same invoice twice at once
+        // and both deliveries would pass a check.
+        $event = $isRenewal ? SubscriptionRecord::EVENT_RENEWAL : SubscriptionRecord::EVENT_INVOICE_PAID;
+
+        return $this->recordOnce(
+            fn () => ($this->record)(
+                event: $event,
+                subscription: $subscription->refresh(),
+                netCents: $isRenewal ? $subscription->price_cents : 0,
+                stripe: [
+                    'invoice' => $invoiceId ?: null,
+                    'subscription' => $subscription->stripe_subscription_id,
+                ],
+                // The exact kind, kept so a proration or a manual charge stays
+                // distinguishable from an ordinary renewal.
+                extra: ['billing_reason' => $reason ?: null],
+                // Stripe's total is what was actually taken, tax and all. Ours
+                // is what was agreed; the register states both.
+                chargedGrossCents: isset($invoice['amount_paid']) ? (int) $invoice['amount_paid'] : null,
+                eventKey: $invoiceId !== '' ? "{$event}:{$invoiceId}" : null,
+            )
+        );
+    }
+
+    /**
+     * A renewal failed. Recorded, and nothing else: Stripe runs the dunning
+     * schedule, and cutting a customer off on the first failed attempt would
+     * punish an expired card as though it were a refusal to pay.
+     *
+     * @param  array<string, mixed>  $invoice
+     */
+    public function invoicePaymentFailed(array $invoice, ?Carbon $eventAt = null): ?SubscriptionRecord
+    {
+        $subscription = $this->resolve($invoice['subscription'] ?? null);
+
+        if ($subscription === null) {
+            return null;
+        }
+
+        $invoiceId = (string) ($invoice['id'] ?? '');
+
+        // Only if this is the newest word we have. A failed attempt delayed
+        // behind the successful retry would otherwise flip a customer who has
+        // since paid back to past_due.
+        $this->mutateInOrder($subscription, $eventAt, self::RANK_FAILED, fn () => ['stripe_status' => 'past_due']);
+
+        return $this->recordOnce(
+            fn () => ($this->record)(
+                event: SubscriptionRecord::EVENT_PAYMENT_FAILED,
+                subscription: $subscription->refresh(),
+                netCents: 0,
+                stripe: [
+                    'invoice' => $invoiceId ?: null,
+                    'subscription' => $subscription->stripe_subscription_id,
+                ],
+                extra: ['attempt' => $invoice['attempt_count'] ?? null],
+                chargedGrossCents: 0,
+                // Per attempt, not per invoice: Stripe retries a failing
+                // payment on a schedule, and each attempt is its own event.
+                eventKey: $invoiceId !== ''
+                    ? 'payment_failed:'.$invoiceId.':'.($invoice['attempt_count'] ?? 0)
+                    : null,
+            )
+        );
+    }
+
+    /**
+     * Stripe's own status changed. Theirs is the authority on whether the money
+     * is arriving; we copy it, and leave what the customer may USE to our own
+     * status, which only a cancellation or an operator changes.
+     *
+     * @param  array<string, mixed>  $object
+     */
+    public function subscriptionUpdated(array $object, ?Carbon $eventAt = null): ?Subscription
+    {
+        $subscription = $this->resolve($object['id'] ?? null);
+
+        if ($subscription === null) {
+            return null;
+        }
+
+        [$start, $end] = $this->period($object);
+
+        // Ended is ended, whatever order events arrive in — and an older
+        // snapshot must never overwrite a newer one it was delivered behind.
+        $this->mutateInOrder($subscription, $eventAt, self::RANK_UPDATED, fn () => array_filter([
+            'stripe_status' => $object['status'] ?? null,
+            'current_period_start' => $start,
+            'current_period_end' => $end,
+        ], fn ($value) => $value !== null));
+
+        return $subscription;
+    }
+
+    /**
+     * The subscription has ended at Stripe. That is the end of the contract,
+     * so it goes in the register — a cancellation nobody recorded is exactly
+     * the kind of gap the register exists to prevent.
+     *
+     * @param  array<string, mixed>  $object
+     */
+    public function subscriptionDeleted(array $object, ?Carbon $eventAt = null): ?SubscriptionRecord
+    {
+        $subscription = $this->resolve($object['id'] ?? null);
+
+        if ($subscription === null) {
+            return null;
+        }
+
+        $endedAt = isset($object['ended_at'])
+            ? Carbon::createFromTimestamp((int) $object['ended_at'])
+            : now();
+
+        // The ending and its entry in the register commit together. Marking the
+        // contract cancelled first and failing before the record would leave a
+        // retry seeing "already cancelled" and returning — and the end of a
+        // contract would never be entered at all.
+        return $this->recordOnce(fn () => DB::transaction(function () use ($subscription, $object, $endedAt, $eventAt) {
+            // Held while we decide, so a renewal arriving at the same moment
+            // cannot reactivate the contract between this and the write.
+            $subscription = Subscription::query()->whereKey($subscription->getKey())->lockForUpdate()->firstOrFail();
+
+            // No ordering guard: an ending is final, so a late delivery of it
+            // is still correct. Only the running picture can go stale.
+            $subscription->update([
+                'status' => 'cancelled',
+                'stripe_status' => $object['status'] ?? 'canceled',
+                'cancelled_at' => $endedAt,
+                'stripe_event_at' => $eventAt,
+            ]);
+
+            return ($this->record)(
+                event: SubscriptionRecord::EVENT_CANCELLATION,
+                subscription: $subscription->refresh(),
+                netCents: 0,
+                at: $endedAt,
+                stripe: ['subscription' => $subscription->stripe_subscription_id],
+                chargedGrossCents: 0,
+                // A contract ends once. Two deliveries arriving together would
+                // both pass a status check; only one can take this key.
+                eventKey: 'cancellation:'.$subscription->id,
+            );
+        }));
+    }
+
+    /**
+     * Whether this event is the newest word we have about the contract.
+     *
+     * Stripe does not guarantee delivery order, and the state here is a
+     * running picture rather than a log: applying a stale snapshot on top of a
+     * fresher one is how a paid-up customer ends up looking overdue. The
+     * register is unaffected — each entry is keyed by what it is about, so a
+     * late arrival still lands once, in its proper place.
+     */
+    /**
+     * Decide and write in one step, with the contract's row held.
+     *
+     * The ordering guard is only worth as much as its atomicity: two
+     * deliveries for the same contract can both read a stale copy, both pass
+     * the check, and the loser then overwrites the winner — a renewal
+     * reactivating a contract a deletion had just ended, or an old failure
+     * burying a payment that went through. So the row is re-read under a lock
+     * and re-judged inside the transaction that writes it.
+     *
+     * `$changes` returns the columns to set, or null to decline.
+     *
+     * @param  callable(Subscription): ?array<string, mixed>  $changes
+     */
+    private function mutateInOrder(Subscription $subscription, ?Carbon $eventAt, int $rank, callable $changes): void
+    {
+        DB::transaction(function () use ($subscription, $eventAt, $rank, $changes) {
+            $fresh = Subscription::query()->whereKey($subscription->getKey())->lockForUpdate()->first();
+
+            if ($fresh === null
+                || $fresh->status === 'cancelled'
+                || ! $this->appliesInOrder($fresh, $eventAt, $rank)) {
+                return;
+            }
+
+            $values = $changes($fresh);
+
+            if ($values === null) {
+                return;
+            }
+
+            if ($eventAt !== null) {
+                $values['stripe_event_at'] = $eventAt;
+                $values['stripe_event_rank'] = $rank;
+            }
+
+            $fresh->update($values);
+        });
+
+        $subscription->refresh();
+    }
+
+    private function appliesInOrder(Subscription $subscription, ?Carbon $eventAt, int $rank): bool
+    {
+        if ($eventAt === null || $subscription->stripe_event_at === null) {
+            return true;   // nothing to compare against
+        }
+
+        if ($eventAt->greaterThan($subscription->stripe_event_at)) {
+            return true;
+        }
+
+        if ($eventAt->lessThan($subscription->stripe_event_at)) {
+            return false;
+        }
+
+        // Same second, which Stripe's one-second timestamps make common enough
+        // to matter: a failed attempt and the retry that succeeded can share
+        // one. Decide by what the event says about the money.
+        return $rank >= (int) ($subscription->stripe_event_rank ?? 0);
+    }
+
+    /**
+     * Write a register entry, unless one already exists for this invoice and
+     * event.
+     *
+     * The uniqueness lives in the database, on (stripe_invoice_id, event).
+     * Checking first and inserting afterwards leaves a window that Stripe
+     * delivering the same invoice twice at once walks straight through — and a
+     * register that counts a payment twice is worse than one that is late.
+     *
+     * @param  callable(): SubscriptionRecord  $write
+     */
+    private function recordOnce(callable $write): ?SubscriptionRecord
+    {
+        try {
+            return $write();
+        } catch (UniqueConstraintViolationException) {
+            return null; // already recorded by a concurrent delivery
+        }
+    }
+
+    /**
+     * Hold an event whose contract does not exist yet, so it is not lost.
+     *
+     * @param  array<string, mixed>  $event
+     */
+    public function hold(array $event): void
+    {
+        $subscriptionId = $event['data']['object']['subscription']
+            ?? $event['data']['object']['id']
+            ?? null;
+
+        if (! is_string($subscriptionId) || ! is_string($event['id'] ?? null)) {
+            return;
+        }
+
+        // Only what we could not match. A handler returns null for several
+        // reasons — already recorded, or deliberately skipped, like every
+        // checkout's own invoice — and holding those would fill the table with
+        // rows that replayHeldFor() can never revisit, because their contract
+        // is right there. Nothing to wait for means nothing to hold.
+        if (Subscription::query()->where('stripe_subscription_id', $subscriptionId)->exists()) {
+            // Unless it appeared just now: the contract can be created between
+            // the handler missing it and this check, and the replay that would
+            // have collected it has then already been and gone. Apply it here
+            // instead of dropping it. Safe to repeat — the handlers are
+            // idempotent, so an event that was a no-op stays one.
+            $this->dispatch($event);
+
+            return;
+        }
+
+        StripePendingEvent::query()->updateOrCreate(
+            ['stripe_event_id' => $event['id']],
+            [
+                'stripe_subscription_id' => $subscriptionId,
+                'type' => (string) ($event['type'] ?? ''),
+                'raised_at' => isset($event['created']) && is_numeric($event['created'])
+                    ? Carbon::createFromTimestamp((int) $event['created'])
+                    : null,
+                'payload' => $event,
+            ],
+        );
+    }
+
+    /**
+     * Replay everything held for a contract that has just appeared.
+     *
+     * In their original order, so the ordering guard sees them as Stripe raised
+     * them rather than as they happened to be stored.
+     */
+    public function replayHeldFor(Subscription $subscription): int
+    {
+        if ($subscription->stripe_subscription_id === null) {
+            return 0;
+        }
+
+        $held = StripePendingEvent::query()
+            ->where('stripe_subscription_id', $subscription->stripe_subscription_id)
+            ->orderBy('raised_at')
+            ->orderBy('id')
+            ->get();
+
+        foreach ($held as $pending) {
+            $this->dispatch($pending->payload ?? []);
+            $pending->delete();
+        }
+
+        return $held->count();
+    }
+
+    /**
+     * Route one event to its handler. Returns false for a type we do not
+     * handle, so the caller can tell "not ours" from "nothing to do".
+     *
+     * @param  array<string, mixed>  $event
+     */
+    public function dispatch(array $event): mixed
+    {
+        $object = $event['data']['object'] ?? [];
+        $raisedAt = isset($event['created']) && is_numeric($event['created'])
+            ? Carbon::createFromTimestamp((int) $event['created'])
+            : null;
+
+        return match ($event['type'] ?? '') {
+            'invoice.paid' => $this->invoicePaid($object, $raisedAt),
+            'invoice.payment_failed' => $this->invoicePaymentFailed($object, $raisedAt),
+            'customer.subscription.updated' => $this->subscriptionUpdated($object, $raisedAt),
+            'customer.subscription.deleted' => $this->subscriptionDeleted($object, $raisedAt),
+            default => false,
+        };
+    }
+
+    /**
+     * Find the contract a Stripe event is about.
+     *
+     * An unknown id is logged and dropped rather than raised: Stripe delivers
+     * events for objects created by hand in the dashboard, and by other
+     * environments pointed at the same endpoint. Failing the webhook for those
+     * would have Stripe retry something that can never succeed.
+     */
+    private function resolve(mixed $stripeSubscriptionId): ?Subscription
+    {
+        $id = is_string($stripeSubscriptionId) ? $stripeSubscriptionId : null;
+
+        if ($id === null) {
+            return null;
+        }
+
+        return Subscription::query()->where('stripe_subscription_id', $id)->first();
+    }
+
+    /**
+     * @param  array<string, mixed>  $object
+     * @return array{0: ?Carbon, 1: ?Carbon}
+     */
+    private function period(array $object): array
+    {
+        $start = $object['period_start'] ?? $object['current_period_start'] ?? null;
+        $end = $object['period_end'] ?? $object['current_period_end'] ?? null;
+
+        return [
+            is_numeric($start) ? Carbon::createFromTimestamp((int) $start) : null,
+            is_numeric($end) ? Carbon::createFromTimestamp((int) $end) : null,
+        ];
+    }
+}

app/Actions/BookAddon.php

@@ -0,0 +1,132 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\Order;
+use App\Models\Subscription;
+use App\Models\SubscriptionAddon;
+use App\Models\SubscriptionRecord;
+use App\Services\Billing\AddonCatalogue;
+use Illuminate\Database\UniqueConstraintViolationException;
+use Illuminate\Support\Facades\DB;
+use RuntimeException;
+
+/**
+ * Books a module onto a contract at today's price, and freezes it there.
+ *
+ * Booking is the moment the module's price stops moving for this customer, for
+ * exactly the reason the plan's price does: they agreed to a figure. What they
+ * have NOT booked stays on the live catalogue — that is a sale still to be
+ * made, at whatever it costs now.
+ */
+class BookAddon
+{
+    public function __construct(private RecordCommercialEvent $record) {}
+
+    public function __invoke(Subscription $subscription, string $addonKey, int $quantity = 1, ?Order $order = null): SubscriptionAddon
+    {
+        $price = app(AddonCatalogue::class)->priceCents($addonKey);
+
+        if ($price === null) {
+            throw new RuntimeException("Unknown add-on: {$addonKey}");
+        }
+
+        if ($quantity < 1) {
+            throw new RuntimeException('An add-on is booked at least once.');
+        }
+
+        try {
+            return $this->book($subscription, $addonKey, $quantity, $order, $price);
+        } catch (UniqueConstraintViolationException) {
+            // A concurrent retry won. The unique index on (order_id, addon_key)
+            // is what actually enforces "one order books one module" — the
+            // lookup below is only the fast path, and two transactions can both
+            // pass it.
+            return SubscriptionAddon::query()
+                ->where('order_id', $order?->id)
+                ->where('addon_key', $addonKey)
+                ->firstOrFail();
+        }
+    }
+
+    private function book(Subscription $subscription, string $addonKey, int $quantity, ?Order $order, int $price): SubscriptionAddon
+    {
+        // The booking and its entry in the register commit together: if the
+        // record could fail afterwards, retrying the same order would find the
+        // add-on already there and skip the event for good.
+        return DB::transaction(function () use ($subscription, $addonKey, $quantity, $order, $price) {
+            // Idempotent against a retried webhook: one order books one module.
+            if ($order !== null) {
+                $existing = SubscriptionAddon::query()
+                    ->where('order_id', $order->id)
+                    ->where('addon_key', $addonKey)
+                    ->first();
+
+                if ($existing !== null) {
+                    return $existing;
+                }
+            }
+
+            $addon = SubscriptionAddon::create([
+                'subscription_id' => $subscription->id,
+                'order_id' => $order?->id,
+                'addon_key' => $addonKey,
+                'price_cents' => $price,
+                'currency' => Subscription::catalogueCurrency(),
+                'quantity' => $quantity,
+                'booked_at' => now(),
+            ]);
+
+            ($this->record)(
+                event: SubscriptionRecord::EVENT_ADDON_BOOKED,
+                subscription: $subscription,
+                netCents: $addon->monthlyCents(),
+                extra: ['addon' => ['key' => $addonKey, 'quantity' => $quantity, 'price_cents' => $price]],
+                order: $order,
+                stripe: ['event' => $order?->stripe_event_id],
+                // What was actually charged for the module, on the same terms
+                // as a plan purchase: a discount or a free booking has to be
+                // reconcilable, not reconstructed from the catalogue.
+                chargedGrossCents: $order?->stripe_event_id !== null ? (int) $order->amount_cents : null,
+            );
+
+            return $addon;
+        });
+    }
+
+    /**
+     * Stop charging for a module, without losing what it cost.
+     *
+     * Cancelled, not deleted: what a customer was paying, and until when, is
+     * part of the same record as what they bought.
+     */
+    public function cancel(SubscriptionAddon $addon): SubscriptionAddon
+    {
+        return DB::transaction(function () use ($addon) {
+            // Claim the cancellation conditionally, so two requests arriving
+            // together write one event between them. Checking `isActive()` on
+            // separate instances and updating afterwards lets both through, and
+            // the register would show a module cancelled twice.
+            $claimed = SubscriptionAddon::query()
+                ->whereKey($addon->getKey())
+                ->whereNull('cancelled_at')
+                ->update(['cancelled_at' => now(), 'updated_at' => now()]);
+
+            if ($claimed === 0) {
+                return $addon->refresh();
+            }
+
+            $addon->refresh();
+
+            ($this->record)(
+                event: SubscriptionRecord::EVENT_ADDON_CANCELLED,
+                subscription: $addon->subscription,
+                netCents: -$addon->monthlyCents(),
+                extra: ['addon' => ['key' => $addon->addon_key, 'quantity' => $addon->quantity]],
+                order: $addon->order,
+            );
+
+            return $addon;
+        });
+    }
+}

app/Actions/Fortify/CreateNewUser.php

@@ -0,0 +1,64 @@
+<?php
+
+namespace App\Actions\Fortify;
+
+use App\Models\Customer;
+use App\Models\User;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\Rule;
+use Illuminate\Validation\ValidationException;
+use Laravel\Fortify\Contracts\CreatesNewUsers;
+
+class CreateNewUser implements CreatesNewUsers
+{
+    use PasswordValidationRules;
+
+    /**
+     * Validate and create a newly registered user.
+     *
+     * @param  array<string, string>  $input
+     *
+     * @throws ValidationException
+     */
+    public function create(array $input): User
+    {
+        Validator::make($input, [
+            'name' => ['required', 'string', 'max:255'],
+            'email' => [
+                'required',
+                'string',
+                'email',
+                'max:255',
+                Rule::unique(User::class),
+                // Never let public signup claim an existing (possibly not-yet-
+                // provisioned) customer's email — ensureUser() would later link
+                // that account and hand over the customer's portal.
+                Rule::unique(Customer::class, 'email'),
+            ],
+            'password' => $this->passwordRules(),
+        ])->validate();
+
+        // Create the user and its linked customer atomically — a public signup is
+        // a customer, and the portal (Billing::purchase, Settings, …) needs one.
+        // Either both exist or neither, so a failure never orphans a user.
+        return DB::transaction(function () use ($input) {
+            $user = User::create([
+                'name' => $input['name'],
+                'email' => $input['email'],
+                'password' => Hash::make($input['password']),
+            ]);
+
+            Customer::query()->create([
+                'user_id' => $user->id,
+                'name' => $input['name'],
+                'email' => $input['email'],
+                'locale' => app()->getLocale(),
+                'status' => 'active',
+            ]);
+
+            return $user;
+        });
+    }
+}

app/Actions/Fortify/PasswordValidationRules.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace App\Actions\Fortify;
+
+use Illuminate\Contracts\Validation\Rule;
+use Illuminate\Validation\Rules\Password;
+
+trait PasswordValidationRules
+{
+    /**
+     * Get the validation rules used to validate passwords.
+     *
+     * @return array<int, Rule|array<mixed>|string>
+     */
+    protected function passwordRules(): array
+    {
+        return ['required', 'string', Password::default(), 'confirmed'];
+    }
+}

app/Actions/Fortify/ResetUserPassword.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Actions\Fortify;
+
+use App\Models\User;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\ValidationException;
+use Laravel\Fortify\Contracts\ResetsUserPasswords;
+
+class ResetUserPassword implements ResetsUserPasswords
+{
+    use PasswordValidationRules;
+
+    /**
+     * Validate and reset the user's forgotten password.
+     *
+     * @param  array<string, string>  $input
+     *
+     * @throws ValidationException
+     */
+    public function reset(User $user, array $input): void
+    {
+        Validator::make($input, [
+            'password' => $this->passwordRules(),
+        ])->validate();
+
+        $user->forceFill([
+            'password' => Hash::make($input['password']),
+        ])->save();
+    }
+}

app/Actions/Fortify/UpdateUserPassword.php

@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Actions\Fortify;
+
+use App\Models\User;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\ValidationException;
+use Laravel\Fortify\Contracts\UpdatesUserPasswords;
+
+class UpdateUserPassword implements UpdatesUserPasswords
+{
+    use PasswordValidationRules;
+
+    /**
+     * Validate and update the user's password.
+     *
+     * @param  array<string, string>  $input
+     *
+     * @throws ValidationException
+     */
+    public function update(User $user, array $input): void
+    {
+        Validator::make($input, [
+            'current_password' => ['required', 'string', 'current_password:web'],
+            'password' => $this->passwordRules(),
+        ], [
+            'current_password.current_password' => __('The provided password does not match your current password.'),
+        ])->validateWithBag('updatePassword');
+
+        $user->forceFill([
+            'password' => Hash::make($input['password']),
+        ])->save();
+    }
+}

app/Actions/Fortify/UpdateUserProfileInformation.php

@@ -0,0 +1,61 @@
+<?php
+
+namespace App\Actions\Fortify;
+
+use App\Models\User;
+use Illuminate\Contracts\Auth\MustVerifyEmail;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\Rule;
+use Illuminate\Validation\ValidationException;
+use Laravel\Fortify\Contracts\UpdatesUserProfileInformation;
+
+class UpdateUserProfileInformation implements UpdatesUserProfileInformation
+{
+    /**
+     * Validate and update the given user's profile information.
+     *
+     * @param  array<string, string>  $input
+     *
+     * @throws ValidationException
+     */
+    public function update(User $user, array $input): void
+    {
+        Validator::make($input, [
+            'name' => ['required', 'string', 'max:255'],
+
+            'email' => [
+                'required',
+                'string',
+                'email',
+                'max:255',
+                Rule::unique('users')->ignore($user->id),
+            ],
+        ])->validateWithBag('updateProfileInformation');
+
+        if ($input['email'] !== $user->email &&
+            $user instanceof MustVerifyEmail) {
+            $this->updateVerifiedUser($user, $input);
+        } else {
+            $user->forceFill([
+                'name' => $input['name'],
+                'email' => $input['email'],
+            ])->save();
+        }
+    }
+
+    /**
+     * Update the given verified user's profile information.
+     *
+     * @param  array<string, string>  $input
+     */
+    protected function updateVerifiedUser(User $user, array $input): void
+    {
+        $user->forceFill([
+            'name' => $input['name'],
+            'email' => $input['email'],
+            'email_verified_at' => null,
+        ])->save();
+
+        $user->sendEmailVerificationNotification();
+    }
+}

app/Actions/OpenSubscription.php

@@ -0,0 +1,96 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\Order;
+use App\Models\Subscription;
+use App\Models\SubscriptionRecord;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\DB;
+
+/**
+ * Opens the contract a paid order bought.
+ *
+ * This is the moment the catalogue stops applying. Everything the customer is
+ * owed — price, quotas, seats, the hardware behind the plan — is copied onto
+ * the subscription here and never read from the catalogue again. Provisioning
+ * sizes the machine from this row, so an operator editing a plan afterwards
+ * cannot reach a customer who has already paid.
+ *
+ * `price_cents` is the catalogue's NET price, which is what PlanChange prorates
+ * against — deliberately not `Order::amount_cents`, which holds the GROSS total
+ * Stripe actually charged. The two can legitimately differ (VAT, and later
+ * coupons), and reconciling them is not this action's job: the proof register
+ * records what was charged per event, and Stripe's invoice is the authority for
+ * the amount. Copying a gross total into this net field would silently corrupt
+ * every pro-rata calculation that reads it.
+ */
+class OpenSubscription
+{
+    public function __construct(private RecordCommercialEvent $record) {}
+
+    public function __invoke(Order $order, string $term = Subscription::TERM_MONTHLY): Subscription
+    {
+        // A retried webhook must not open a second contract for one purchase.
+        $existing = Subscription::query()->where('order_id', $order->id)->first();
+
+        if ($existing !== null) {
+            return $existing;
+        }
+
+        $start = now();
+
+        // The contract and its entry in the register commit together. If the
+        // record could fail after the subscription is in, the next webhook
+        // retry would find the contract, return early, and leave a paid sale
+        // permanently missing from the evidence.
+        return DB::transaction(fn () => $this->open($order, $term, $start));
+    }
+
+    private function open(Order $order, string $term, Carbon $start): Subscription
+    {
+        $subscription = Subscription::create(array_merge(
+            // The version the order carries, when the checkout recorded one:
+            // what the customer saw beats what happens to be on sale by the
+            // time their payment reaches us.
+            Subscription::snapshotFrom($order->plan, $term, $order->plan_version_id),
+            [
+                'customer_id' => $order->customer_id,
+                'order_id' => $order->id,
+                // Carried from the checkout: from here on, Stripe's events
+                // name this and nothing else.
+                'stripe_subscription_id' => $order->stripe_subscription_id,
+                'started_at' => $start,
+                'current_period_start' => $start,
+                'current_period_end' => $term === Subscription::TERM_YEARLY
+                    ? $start->copy()->addYear()
+                    : $start->copy()->addMonth(),
+                'status' => 'active',
+            ],
+        ));
+
+        // The sale, entered in the register the moment it happens. Written from
+        // the contract that was just frozen, so the evidence and the contract
+        // cannot describe different purchases.
+        ($this->record)(
+            event: SubscriptionRecord::EVENT_PURCHASE,
+            subscription: $subscription,
+            netCents: $subscription->price_cents,
+            at: $start,
+            stripe: ['event' => $order->stripe_event_id],
+            // The order carries what Stripe actually took — gross, including
+            // whatever tax or discount applied on the day. The contract price
+            // is what was agreed; this is what was paid, and the register has
+            // to be able to state both.
+            //
+            // Keyed on the Stripe id, not on the amount being non-zero: a fully
+            // discounted checkout charges zero, and reading that as "no amount
+            // recorded" would file a free sale as though it had been paid for
+            // in full. An order without a Stripe id was never charged through
+            // a checkout at all, and has nothing to report.
+            chargedGrossCents: $order->stripe_event_id !== null ? (int) $order->amount_cents : null,
+        );
+
+        return $subscription;
+    }
+}

app/Actions/RecordCommercialEvent.php

@@ -0,0 +1,146 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\Order;
+use App\Models\Subscription;
+use App\Models\SubscriptionRecord;
+use App\Services\Billing\TaxTreatment;
+use Illuminate\Support\Carbon;
+
+/**
+ * Writes one row into the proof register.
+ *
+ * Every commercial event goes through here so that the flat columns are filled
+ * the same way each time — an evidence table where the amount means one thing
+ * in one row and another in the next is not evidence.
+ *
+ * Amounts are stated three ways on purpose. Net is what the catalogue and the
+ * contract deal in; gross is what was actually charged; the tax between them
+ * depends on the customer and on the day, and recomputing it later from a rate
+ * that has since changed would produce a different answer to the one on the
+ * invoice.
+ */
+class RecordCommercialEvent
+{
+    /**
+     * @param  array<string, mixed>  $extra  merged into the JSON snapshot
+     * @param  array<string, string|null>  $stripe  event / invoice / subscription ids
+     */
+    public function __invoke(
+        string $event,
+        Subscription $subscription,
+        int $netCents,
+        ?Carbon $at = null,
+        array $extra = [],
+        array $stripe = [],
+        ?int $chargedGrossCents = null,
+        ?Order $order = null,
+        ?string $eventKey = null,
+    ): SubscriptionRecord {
+        $at ??= now();
+        $customer = $subscription->customer;
+        $tax = TaxTreatment::for($customer);
+
+        $agreedNet = $netCents;
+        $expectedGross = $tax->grossCents($agreedNet);
+
+        // The flat columns describe the TRANSACTION, not the contract: gross is
+        // what was taken from the customer, and net and tax are that gross
+        // split by the rate that applied on the day.
+        //
+        // Split, not subtracted from the agreed price. A discount lowers the
+        // taxable amount; it does not create negative VAT, and recording
+        // 14900 charged against a 179,00 contract as "minus 30,00 tax" would
+        // make the register wrong in exactly the case someone audits.
+        if ($chargedGrossCents !== null) {
+            $gross = $chargedGrossCents;
+            $net = (int) round($gross / (1 + $tax->rate));
+        } else {
+            $net = $agreedNet;
+            $gross = $expectedGross;
+        }
+
+        $version = $subscription->planVersion;
+
+        return SubscriptionRecord::create([
+            'event' => $event,
+            // What makes this event "the same one" if it arrives again. Unique
+            // where set, so a duplicate delivery collides in the database
+            // rather than in a check that two of them can both pass.
+            'event_key' => $eventKey,
+
+            'customer_id' => $subscription->customer_id,
+            'subscription_id' => $subscription->id,
+            // The order this event belongs to — a booked module has its own,
+            // and pointing it at the original plan purchase would file every
+            // add-on under the wrong transaction.
+            'order_id' => $order?->id ?? $subscription->order_id,
+            'plan_version_id' => $subscription->plan_version_id,
+
+            // Copied rather than joined: these have to still answer the question
+            // after the customer, the plan or the version have gone.
+            'customer_name' => $customer?->name,
+            'plan_key' => $subscription->plan,
+            'plan_version' => $version?->version,
+            'term' => $subscription->term,
+
+            'net_cents' => $net,
+            'tax_cents' => $gross - $net,
+            'gross_cents' => $gross,
+            'currency' => $subscription->currency,
+            'tax_rate' => round($tax->rate * 100, 2),
+            'reverse_charge' => $tax->reverseCharge,
+
+            'stripe_event_id' => $stripe['event'] ?? null,
+            'stripe_invoice_id' => $stripe['invoice'] ?? null,
+            'stripe_subscription_id' => $stripe['subscription'] ?? null,
+
+            'occurred_at' => $at,
+
+            'snapshot_version' => SubscriptionRecord::SNAPSHOT_VERSION,
+            // The long tail: everything nobody has thought to ask about yet.
+            // The flat columns above are what gets queried.
+            'snapshot' => array_merge([
+                'subscription' => $subscription->only(Subscription::FROZEN),
+                'plan' => [
+                    'key' => $subscription->plan,
+                    'version' => $version?->version,
+                    'version_id' => $subscription->plan_version_id,
+                    'family' => $version?->family?->name,
+                    'capabilities' => $version?->capabilities(),
+                ],
+                'period' => [
+                    'start' => $subscription->current_period_start?->toIso8601String(),
+                    'end' => $subscription->current_period_end?->toIso8601String(),
+                ],
+                'addons' => $subscription->addons()->active()->get()
+                    ->map(fn ($addon) => [
+                        'key' => $addon->addon_key,
+                        'price_cents' => $addon->price_cents,
+                        'quantity' => $addon->quantity,
+                        'booked_at' => $addon->booked_at?->toIso8601String(),
+                    ])->all(),
+                'customer' => [
+                    'name' => $customer?->name,
+                    'email' => $customer?->email,
+                    'vat_id' => $customer?->vat_id,
+                ],
+                // Kept even when they agree. A charge that differs from the
+                // catalogue plus tax is exactly the thing someone will ask
+                // about later, and reconciling it silently would erase the
+                // question along with the answer.
+                'amounts' => [
+                    // What was agreed, beside what was actually taken. The
+                    // flat columns state the transaction; this states whether
+                    // it came out at the contract price, which is the question
+                    // someone asks a year later.
+                    'agreed_net_cents' => $agreedNet,
+                    'expected_gross_cents' => $expectedGross,
+                    'charged_gross_cents' => $gross,
+                    'matches_catalogue' => $gross === $expectedGross,
+                ],
+            ], $extra),
+        ]);
+    }
+}

app/Actions/StartCustomerProvisioning.php

@@ -0,0 +1,230 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\Customer;
+use App\Models\Order;
+use App\Models\ProvisioningRun;
+use App\Models\Subscription;
+use App\Provisioning\Jobs\AdvanceRunJob;
+use App\Services\Billing\PlanCatalogue;
+use Illuminate\Database\UniqueConstraintViolationException;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Log;
+use Throwable;
+
+/**
+ * Turns a paid Stripe event into a customer + order + provisioning run. The
+ * order's unique stripe_event_id is the idempotency key: a duplicate webhook
+ * never starts a second run.
+ */
+class StartCustomerProvisioning
+{
+    public function __construct(
+        private OpenSubscription $openSubscription,
+        private ApplyStripeBillingEvent $billing,
+    ) {}
+
+    /**
+     * @param  array{id:string,email:string,name:?string,stripe_customer_id:?string,plan:string,datacenter:string,amount_cents:int,currency:string}  $event
+     */
+    public function fromStripeEvent(array $event): ?Order
+    {
+        $existing = Order::query()->where('stripe_event_id', $event['id'])->first();
+
+        if ($existing !== null) {
+            $this->resume($existing);
+
+            return null;
+        }
+
+        $customer = $this->resolveCustomer($event);
+        $customer->ensureUser(); // portal login (also enables admin impersonation)
+
+        try {
+            [$order, $run] = DB::transaction(function () use ($event, $customer) {
+                $order = Order::create([
+                    'customer_id' => $customer->id,
+                    'plan' => $event['plan'],
+                    // Set once Stripe checkout carries it (phase 5). Null means
+                    // "whatever is on sale when the webhook lands", which is
+                    // what this did before the column existed.
+                    'plan_version_id' => $event['plan_version_id'] ?? null,
+                    'amount_cents' => $event['amount_cents'],
+                    'currency' => $event['currency'],
+                    'datacenter' => $event['datacenter'],
+                    'stripe_event_id' => $event['id'],
+                    'stripe_subscription_id' => $event['stripe_subscription_id'] ?? null,
+                    'status' => 'paid',
+                ]);
+
+                $run = ProvisioningRun::create([
+                    'subject_type' => Order::class,
+                    'subject_id' => $order->id,
+                    'pipeline' => 'customer',
+                    'status' => ProvisioningRun::STATUS_PENDING,
+                    'current_step' => 0,
+                    // Snapshot resolved branding so retries apply identical inputs
+                    // (unset customer → CluPilot defaults, resolved once here).
+                    'context' => ['branding' => $customer->brandingResolved()],
+                ]);
+
+                return [$order, $run];
+            });
+        } catch (UniqueConstraintViolationException) {
+            // A concurrent delivery won the race. Both requests will answer
+            // Stripe with a 2xx, so this is the last look anyone takes at this
+            // payment — if the winner then dies before opening the contract, no
+            // retry is coming to fix it. So finish its work rather than just
+            // stepping aside. The unique index on subscriptions.order_id keeps
+            // both from opening one.
+            $winner = Order::query()->where('stripe_event_id', $event['id'])->first();
+
+            if ($winner !== null) {
+                $this->resume($winner);
+            }
+
+            return null;
+        }
+
+        $this->openContract($order);
+
+        AdvanceRunJob::dispatch($run->uuid); // after commit
+
+        return $order;
+    }
+
+    /**
+     * Finish what a crash interrupted.
+     *
+     * The order commits before the contract is opened, so that a failure there
+     * can never erase the record of a payment — but that leaves a window in
+     * which a paid order exists with no contract and nothing running. Stripe
+     * retries until it gets a 2xx, so a retry is exactly the chance to close
+     * that window. Simply returning "already processed" would strand a paying
+     * customer permanently, because no later webhook would ever look again.
+     *
+     * Safe to run on every duplicate: opening a contract is idempotent. A run
+     * that was merely never dispatched needs no nudge from here — the scheduler
+     * tick sweeps pending runs. A run that already ran and FAILED for want of
+     * the contract does, because nothing sweeps failed runs.
+     */
+    private function resume(Order $order): void
+    {
+        if ($order->subscription()->exists()) {
+            return;
+        }
+
+        $this->openContract($order);
+
+        if ($order->subscription()->exists()) {
+            $this->reviveRunStrandedWithoutAContract($order);
+        }
+    }
+
+    /**
+     * Restart a run that failed only because the contract was missing.
+     *
+     * Narrow on purpose. `no_subscription` is returned before anything is built
+     * — the run never got past validating the order or reserving resources — so
+     * there is nothing half-made to trip over. A run that failed for any other
+     * reason failed at something a contract does not fix, and restarting it
+     * would just repeat whatever went wrong.
+     */
+    private function reviveRunStrandedWithoutAContract(Order $order): void
+    {
+        $run = $order->runs()->where('pipeline', 'customer')->latest('id')->first();
+
+        if ($run?->status !== ProvisioningRun::STATUS_FAILED
+            || ! str_contains((string) $run->error, 'no_subscription')) {
+            return;
+        }
+
+        // onProvisioningFailed() marked the order failed on the way down.
+        $order->update(['status' => 'paid']);
+
+        $run->update([
+            'status' => ProvisioningRun::STATUS_PENDING,
+            'current_step' => 0,
+            'attempt' => 0,
+            'next_attempt_at' => null,
+            'error' => null,
+        ]);
+
+        AdvanceRunJob::dispatch($run->uuid);
+
+        Log::info('Restarted a run that was stranded without a contract.', [
+            'order_id' => $order->id, 'run' => $run->uuid,
+        ]);
+    }
+
+    /**
+     * Freeze what they bought, while the catalogue still says what they were
+     * shown.
+     *
+     * Deliberately AFTER the order is committed, and deliberately swallowing
+     * its failure. The order is the record that money changed hands: if opening
+     * the contract could roll it back, an unsellable plan, a missing price or
+     * any unforeseen fault would erase the evidence of a payment we have
+     * already taken — and Stripe, seeing no 2xx, would retry a webhook that can
+     * never succeed. A missing contract is recoverable and loud: the run stops
+     * at ValidateOrder with `no_subscription`, in the operator's face.
+     *
+     * Two cases are expected to land here: a plan the catalogue cannot sell,
+     * and a payment in a currency it cannot price — freezing a EUR price onto a
+     * CHF payment would put the contract and the payment in permanent
+     * disagreement.
+     */
+    private function openContract(Order $order): void
+    {
+        try {
+            // A checkout that recorded its version is owed THAT version, even
+            // if the window has closed or the plan has been withdrawn since —
+            // they paid for what they were shown. Only a purchase with no
+            // recorded version has to ask what is on sale now.
+            $deliverable = $order->plan_version_id !== null
+                ? app(PlanCatalogue::class)->isDeliverable($order->plan, $order->plan_version_id)
+                : Subscription::knowsPlan($order->plan);
+
+            $sellable = $deliverable
+                && strtoupper((string) $order->currency) === Subscription::catalogueCurrency();
+
+            if (! $sellable) {
+                Log::warning('No contract opened: the catalogue cannot sell this order.', [
+                    'order_id' => $order->id, 'plan' => $order->plan, 'currency' => $order->currency,
+                ]);
+
+                return;
+            }
+
+            $subscription = ($this->openSubscription)($order);
+
+            // Anything Stripe sent about this contract before it existed —
+            // a renewal, a failure, a cancellation — applied now, in the order
+            // they were raised.
+            $this->billing->replayHeldFor($subscription);
+        } catch (Throwable $e) {
+            Log::error('Failed to open a contract for a paid order.', [
+                'order_id' => $order->id, 'plan' => $order->plan, 'error' => $e->getMessage(),
+            ]);
+        }
+    }
+
+    /**
+     * Find or create the customer, race-safe against the unique email index so a
+     * concurrent first-time purchase can't create two customers for one email.
+     *
+     * @param  array{email:string,name:?string,stripe_customer_id:?string}  $event
+     */
+    private function resolveCustomer(array $event): Customer
+    {
+        try {
+            return Customer::query()->firstOrCreate(
+                ['email' => $event['email']],
+                ['name' => $event['name'] ?? $event['email'], 'stripe_customer_id' => $event['stripe_customer_id'] ?? null],
+            );
+        } catch (UniqueConstraintViolationException) {
+            return Customer::query()->where('email', $event['email'])->firstOrFail();
+        }
+    }
+}

app/Actions/StartHostOnboarding.php

@@ -0,0 +1,49 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\Host;
+use App\Models\ProvisioningRun;
+use App\Provisioning\Jobs\AdvanceRunJob;
+use Illuminate\Support\Facades\Crypt;
+use Illuminate\Support\Facades\DB;
+
+/**
+ * Registers a fresh host and kicks off its onboarding run. The one-time root
+ * password lives encrypted in the run context and is scrubbed after SSH trust
+ * is established.
+ */
+class StartHostOnboarding
+{
+    /**
+     * @param  array{name: string, datacenter: string, public_ip: string, root_password: string}  $input
+     */
+    public function run(array $input): Host
+    {
+        // Host + run are created atomically; a partial insert would otherwise
+        // leave a permanently pending host with no run.
+        [$host, $run] = DB::transaction(function () use ($input) {
+            $host = Host::create([
+                'name' => $input['name'],
+                'datacenter' => $input['datacenter'],
+                'public_ip' => $input['public_ip'],
+                'status' => 'pending',
+            ]);
+
+            $run = ProvisioningRun::create([
+                'subject_type' => Host::class,
+                'subject_id' => $host->id,
+                'pipeline' => 'host',
+                'status' => ProvisioningRun::STATUS_PENDING,
+                'current_step' => 0,
+                'context' => ['root_password' => Crypt::encryptString($input['root_password'])],
+            ]);
+
+            return [$host, $run];
+        });
+
+        AdvanceRunJob::dispatch($run->uuid); // after commit — the run definitely exists
+
+        return $host;
+    }
+}

app/Console/Commands/CheckPlanCatalogue.php

@@ -0,0 +1,99 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\PlanFamily;
+use App\Models\PlanVersion;
+use App\Models\Subscription;
+use Illuminate\Console\Command;
+
+/**
+ * Tells the owner whether the catalogue is in a state that can actually sell.
+ *
+ * Everything here is computed at read time, which means a broken window or a
+ * missing price does not announce itself until a customer hits it. This is the
+ * thing to run after editing plans — before finding out from a failed checkout.
+ */
+class CheckPlanCatalogue extends Command
+{
+    protected $signature = 'plans:check';
+
+    protected $description = 'Check the plan catalogue for overlaps, gaps and missing prices';
+
+    public function handle(): int
+    {
+        $currency = Subscription::catalogueCurrency();
+        $problems = [];
+        $now = now();
+
+        $families = PlanFamily::query()->with('versions.prices')->orderBy('tier')->get();
+
+        if ($families->isEmpty()) {
+            $this->error('The catalogue is empty. Nothing can be sold.');
+
+            return self::FAILURE;
+        }
+
+        foreach ($families as $family) {
+            $live = $family->versions->filter(fn (PlanVersion $v) => $v->isAvailableAt($now));
+
+            if ($live->count() > 1) {
+                $problems[] = "{$family->key}: {$live->count()} versions on sale at once (".
+                    $live->pluck('version')->implode(', ').') — overlapping windows.';
+            }
+
+            if ($family->sales_enabled && $live->isEmpty()) {
+                $problems[] = "{$family->key}: on sale, but no version is available right now.";
+            }
+
+            foreach ($family->versions as $version) {
+                if (! $version->isPublished()) {
+                    continue;
+                }
+
+                foreach ([Subscription::TERM_MONTHLY, Subscription::TERM_YEARLY] as $term) {
+                    $priced = $version->prices
+                        ->first(fn ($p) => $p->term === $term && $p->currency === $currency);
+
+                    if ($priced === null) {
+                        $problems[] = "{$family->key} v{$version->version}: no {$term} price in {$currency}.";
+                    }
+                }
+            }
+        }
+
+        // A contract that cannot say which version it was sold under has lost
+        // its provenance, which is the one thing the version table is for.
+        $orphaned = Subscription::query()->whereNull('plan_version_id')->count();
+
+        if ($orphaned > 0) {
+            $problems[] = "{$orphaned} subscription(s) have no plan version recorded.";
+        }
+
+        foreach ($families as $family) {
+            $state = $family->sales_enabled ? 'on sale' : 'withdrawn';
+            $version = $family->versions->first(fn (PlanVersion $v) => $v->isAvailableAt($now));
+            $this->line(sprintf(
+                '  %-12s tier %d  %-10s %s',
+                $family->key,
+                $family->tier,
+                $state,
+                $version !== null ? "v{$version->version}" : '—',
+            ));
+        }
+
+        if ($problems === []) {
+            $this->newLine();
+            $this->info('Catalogue is consistent.');
+
+            return self::SUCCESS;
+        }
+
+        $this->newLine();
+        foreach ($problems as $problem) {
+            $this->error('  '.$problem);
+        }
+
+        return self::FAILURE;
+    }
+}

app/Console/Commands/CreateAdmin.php

@@ -0,0 +1,79 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\Customer;
+use App\Models\User;
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Validation\Rules\Password;
+use Illuminate\Support\Facades\Validator;
+use Spatie\Permission\PermissionRegistrar;
+
+/**
+ * Creates (or promotes) an operator with the Owner role — the account the
+ * installer sets up so a fresh server is usable immediately.
+ *
+ * Promotion is deliberate: running this twice with the same address should fix
+ * a lost role, not fail with "email already taken".
+ */
+class CreateAdmin extends Command
+{
+    protected $signature = 'clupilot:create-admin
+                            {--email= : Login address}
+                            {--name= : Display name}
+                            {--password= : Leave empty to be prompted}';
+
+    protected $description = 'Create or promote an operator account with the Owner role';
+
+    public function handle(): int
+    {
+        $email = $this->option('email') ?: $this->ask('Email');
+        $name = $this->option('name') ?: $this->ask('Name', 'Administrator');
+        $password = $this->option('password') ?: $this->secret('Password');
+
+        $validator = Validator::make(
+            ['email' => $email, 'name' => $name, 'password' => $password],
+            [
+                'email' => 'required|email|max:255',
+                'name' => 'required|string|max:255',
+                'password' => ['required', Password::min(12)],
+            ],
+        );
+
+        if ($validator->fails()) {
+            foreach ($validator->errors()->all() as $error) {
+                $this->error($error);
+            }
+
+            return self::FAILURE;
+        }
+
+        // An operator address that also belongs to a customer would block that
+        // customer from ever getting a portal login.
+        if (Customer::query()->where('email', $email)->exists()) {
+            $this->error('That address already belongs to a customer.');
+
+            return self::FAILURE;
+        }
+
+        $user = User::query()->firstOrNew(['email' => $email]);
+        $existed = $user->exists;
+
+        $user->fill([
+            'name' => $name,
+            'password' => Hash::make($password),
+            'is_admin' => true,
+            'email_verified_at' => $user->email_verified_at ?? now(),
+        ])->save();
+
+        $user->syncRoles(['Owner']);
+        app(PermissionRegistrar::class)->forgetCachedPermissions();
+
+        $this->info($existed
+            ? "Existing account {$email} promoted to Owner and password reset."
+            : "Owner account {$email} created.");
+
+        return self::SUCCESS;
+    }
+}

app/Console/Commands/SyncStripeCatalogue.php

@@ -0,0 +1,135 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\PlanFamily;
+use App\Models\PlanPrice;
+use App\Models\PlanVersion;
+use App\Services\Stripe\StripeClient;
+use Illuminate\Console\Command;
+
+/**
+ * Mirrors our catalogue into Stripe: a Product per plan family, a Price per
+ * priced row.
+ *
+ * Stripe owns the recurring billing — retries, dunning, off-session SCA,
+ * invoice numbering — so it needs to know what it is billing for. It does not
+ * need to know how big the VM is, and it is not asked.
+ *
+ * Idempotent by construction: a row that already carries an id is skipped. That
+ * matters more here than usual, because a Stripe Price cannot be edited, so a
+ * second run that minted duplicates would leave two live prices for one plan
+ * and no way to tell which a customer is on.
+ *
+ * Only PUBLISHED versions are synced. A draft has promised nothing, and a
+ * Product for it would be a price list entry for something that may never
+ * exist.
+ */
+class SyncStripeCatalogue extends Command
+{
+    protected $signature = 'stripe:sync-catalogue {--dry-run : Show what would be created without touching Stripe}';
+
+    protected $description = 'Create the Stripe products and prices for the plan catalogue';
+
+    public function handle(StripeClient $stripe): int
+    {
+        $dryRun = (bool) $this->option('dry-run');
+
+        if (! $dryRun && ! $stripe->isConfigured()) {
+            $this->error('Stripe is not configured (STRIPE_SECRET is empty). Nothing was created.');
+
+            return self::FAILURE;
+        }
+
+        $created = 0;
+
+        foreach (PlanFamily::query()->with('versions.prices')->orderBy('tier')->get() as $family) {
+            $published = $family->versions->filter(fn (PlanVersion $version) => $version->isPublished());
+
+            // A family whose versions are all drafts has promised nothing, so
+            // it has no business appearing in Stripe's price list yet.
+            if ($published->isEmpty()) {
+                continue;
+            }
+
+            $productId = $family->stripe_product_id;
+
+            if ($productId === null) {
+                $this->line("  product  {$family->key} — {$family->name}");
+                $created++;
+
+                if (! $dryRun) {
+                    $productId = $stripe->createProduct(
+                        $family->name,
+                        ['plan_family' => $family->key, 'plan_family_id' => (string) $family->id],
+                        // Keyed on our row, so a crash between Stripe creating
+                        // the product and us storing its id gives back the same
+                        // product on the next run rather than a second one.
+                        idempotencyKey: "clupilot-product-{$family->id}",
+                    );
+                    $family->update(['stripe_product_id' => $productId]);
+                }
+            }
+
+            foreach ($published as $version) {
+                foreach ($version->prices as $price) {
+                    if ($price->stripe_price_id !== null) {
+                        continue;
+                    }
+
+                    $this->line(sprintf(
+                        '  price    %s v%d %s %d %s',
+                        $family->key, $version->version, $price->term, $price->amount_cents, $price->currency,
+                    ));
+                    $created++;
+
+                    if ($dryRun || $productId === null) {
+                        continue;
+                    }
+
+                    $priceId = $stripe->createPrice(
+                        productId: $productId,
+                        amountCents: $price->amount_cents,
+                        currency: $price->currency,
+                        interval: $price->term === 'yearly' ? 'year' : 'month',
+                        metadata: [
+                            'plan_family' => $family->key,
+                            'plan_version' => (string) $version->version,
+                            'plan_version_id' => (string) $version->id,
+                            'plan_price_id' => (string) $price->id,
+                        ],
+                        idempotencyKey: "clupilot-price-{$price->id}",
+                    );
+
+                    // Written straight through the query builder: stripe_price_id
+                    // is not part of what publication froze, and the model would
+                    // otherwise have to be re-read first.
+                    PlanPrice::query()->whereKey($price->id)->update(['stripe_price_id' => $priceId]);
+                }
+            }
+        }
+
+        $this->newLine();
+
+        if ($created === 0) {
+            $this->info('Stripe is already in step with the catalogue.');
+
+            return self::SUCCESS;
+        }
+
+        $this->info($dryRun
+            ? "{$created} object(s) would be created. Run without --dry-run to create them."
+            : "{$created} object(s) created in Stripe.");
+
+        return self::SUCCESS;
+    }
+
+    /** Versions whose prices are live in Stripe, for the status line. */
+    public static function syncedVersions(): int
+    {
+        return PlanVersion::query()
+            ->whereNotNull('published_at')
+            ->whereHas('prices', fn ($q) => $q->whereNotNull('stripe_price_id'))
+            ->count();
+    }
+}

app/Console/TickProvisioning.php

@@ -0,0 +1,46 @@
+<?php
+
+namespace App\Console;
+
+use App\Models\ProvisioningRun;
+use App\Provisioning\Jobs\AdvanceRunJob;
+
+/**
+ * Scheduler tick (every minute): dispatch an advance job for every run that is
+ * due. Immediate dispatch on advance handles the fast path; this catches
+ * waiting/retrying runs and anything a crashed worker left behind.
+ *
+ * PENDING counts as left behind. A run is created and dispatched in two steps,
+ * and a process that dies between them leaves a paid customer with a run that
+ * nothing will ever pick up. Re-dispatching one that is merely fresh is free —
+ * the runner takes a per-run lock and the second job returns immediately.
+ */
+class TickProvisioning
+{
+    /**
+     * How long a run may sit pending before it counts as stranded.
+     *
+     * Long enough that an ordinary queue backlog is not mistaken for a crash:
+     * sweeping a run whose first job is merely still queued would start a
+     * second chain of continuations alongside the first, and both would keep
+     * dispatching for the rest of the pipeline.
+     */
+    private const STRANDED_AFTER_MINUTES = 5;
+
+    public function __invoke(): void
+    {
+        ProvisioningRun::query()
+            ->where(function ($q) {
+                $q
+                    ->whereIn('status', [ProvisioningRun::STATUS_RUNNING, ProvisioningRun::STATUS_WAITING])
+                    ->orWhere(fn ($stranded) => $stranded
+                        ->where('status', ProvisioningRun::STATUS_PENDING)
+                        ->where('created_at', '<=', now()->subMinutes(self::STRANDED_AFTER_MINUTES)));
+            })
+            ->where(function ($q) {
+                $q->whereNull('next_attempt_at')->orWhere('next_attempt_at', '<=', now());
+            })
+            ->get()
+            ->each(fn (ProvisioningRun $run) => AdvanceRunJob::dispatch($run->uuid));
+    }
+}

app/Http/Controllers/Controller.php

@@ -2,7 +2,9 @@
 
 namespace App\Http\Controllers;
 
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+
 abstract class Controller
 {
-    //
+    use AuthorizesRequests;
 }

app/Http/Controllers/ImpersonationController.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Models\Customer;
+use App\Models\User;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Support\Facades\Auth;
+
+/**
+ * Admin impersonation: an admin can log in as a customer's portal account to
+ * inspect their portal during an incident, then return to the admin session.
+ */
+class ImpersonationController extends Controller
+{
+    /** Admin-gated: become the customer. */
+    public function start(Customer $customer): RedirectResponse
+    {
+        $this->authorize('customers.impersonate');
+        $user = $customer->ensureUser();
+
+        session(['impersonator_id' => Auth::id()]);
+        Auth::login($user);
+
+        return redirect()->route('dashboard');
+    }
+
+    /** Return to the admin session (available while impersonating). */
+    public function leave(): RedirectResponse
+    {
+        $adminId = session()->pull('impersonator_id');
+
+        if ($adminId !== null && ($admin = User::query()->find($adminId)) !== null) {
+            Auth::login($admin);
+
+            return redirect()->route('admin.overview');
+        }
+
+        return redirect()->route('dashboard');
+    }
+}

app/Http/Controllers/StripeWebhookController.php

@@ -0,0 +1,137 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Actions\ApplyStripeBillingEvent;
+use App\Actions\StartCustomerProvisioning;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+/**
+ * Stripe webhook: verifies the signature (when a secret is configured) and turns
+ * a paid checkout into a provisioning run. Idempotent via the order's
+ * stripe_event_id — Stripe retries a webhook until it gets a 2xx.
+ */
+class StripeWebhookController extends Controller
+{
+    public function __invoke(
+        Request $request,
+        StartCustomerProvisioning $action,
+        ApplyStripeBillingEvent $billing,
+    ): JsonResponse {
+        $payload = $request->getContent();
+        $secret = (string) config('services.stripe.webhook_secret');
+
+        if (blank($secret)) {
+            // Fail closed: an unconfigured secret must not authorize provisioning
+            // outside local/testing.
+            abort_unless(app()->environment('local', 'testing'), 400, 'Stripe webhook secret not configured');
+        } elseif (! $this->signatureValid($payload, (string) $request->header('Stripe-Signature'), $secret)) {
+            abort(400, 'invalid signature');
+        }
+
+        $event = json_decode($payload, true) ?: [];
+        $object = $event['data']['object'] ?? [];
+        $type = $event['type'] ?? '';
+
+        // The billing cycle is Stripe's: once a contract exists, they decide
+        // when it renews, when a payment failed, and when it has ended. Handled
+        // before the checkout branch because none of these are checkouts.
+        $applied = $billing->dispatch($event);
+
+        if ($applied !== false) {
+            if ($applied === null) {
+                // Either already applied, or about a contract that does not
+                // exist yet — a checkout takes a moment to become one, and
+                // Stripe does not deliver in order. Holding it costs a row and
+                // saves a cancellation we would otherwise never hear about
+                // again; a replay is a no-op if it was simply a duplicate.
+                $billing->hold($event);
+            }
+
+            // 2xx either way. Stripe retrying would not change the answer, and
+            // anything worth replaying is now held rather than dropped.
+            return response()->json(['handled' => $type, 'applied' => $applied !== null]);
+        }
+
+        // Paid triggers: a synchronous checkout (completed + paid) OR an async
+        // method clearing later (async_payment_succeeded). Ignore everything else,
+        // including the still-unpaid completed event for async methods.
+        $paid = ($type === 'checkout.session.completed' && ($object['payment_status'] ?? null) === 'paid')
+            || $type === 'checkout.session.async_payment_succeeded';
+        if (! $paid) {
+            return response()->json(['ignored' => true]);
+        }
+
+        $meta = $object['metadata'] ?? [];
+
+        // A real email is required — never merge unrelated customers under a
+        // manufactured address or send credentials into the void.
+        $email = $object['customer_details']['email'] ?? $object['customer_email'] ?? ($meta['email'] ?? null);
+        if (blank($email)) {
+            return response()->json(['ignored' => 'no_customer_email']);
+        }
+
+        $action->fromStripeEvent([
+            // Deduplicate on the checkout session id (stable across the completed
+            // and async-succeeded events for one purchase), not the event id.
+            'id' => (string) ($object['id'] ?? $event['id'] ?? ''),
+            'email' => $email,
+            'name' => $object['customer_details']['name'] ?? ($meta['name'] ?? null),
+            'stripe_customer_id' => $object['customer'] ?? null,
+            // The handle every later billing event arrives with. Without it an
+            // invoice.paid cannot be matched to the contract it renews.
+            'stripe_subscription_id' => is_string($object['subscription'] ?? null) ? $object['subscription'] : null,
+            'plan' => $meta['plan'] ?? 'start',
+            // What the customer was actually shown. Absent on a session created
+            // before phase 5 put it there, and then the version on sale applies.
+            'plan_version_id' => isset($meta['plan_version_id']) ? (int) $meta['plan_version_id'] : null,
+            'datacenter' => $meta['datacenter'] ?? 'fsn',
+            'amount_cents' => (int) ($object['amount_total'] ?? $object['amount'] ?? 0),
+            'currency' => strtoupper($object['currency'] ?? 'eur'),
+        ]);
+
+        return response()->json(['ok' => true]);
+    }
+
+    /** Stripe's default replay tolerance, in seconds. */
+    private const SIGNATURE_TOLERANCE = 300;
+
+    /** Verify Stripe's `t=…,v1=…` signature: HMAC-SHA256 of "{t}.{payload}". */
+    private function signatureValid(string $payload, string $header, string $secret): bool
+    {
+        if (blank($header)) {
+            return false;
+        }
+
+        $timestamp = null;
+        $signatures = [];
+        foreach (explode(',', $header) as $segment) {
+            [$key, $value] = array_pad(explode('=', $segment, 2), 2, '');
+            if ($key === 't') {
+                $timestamp = $value;
+            } elseif ($key === 'v1') {
+                $signatures[] = $value; // keep every v1 (secret rotation sends several)
+            }
+        }
+
+        if ($timestamp === null || $signatures === []) {
+            return false;
+        }
+
+        // Reject replays outside the tolerance window.
+        if (abs(time() - (int) $timestamp) > self::SIGNATURE_TOLERANCE) {
+            return false;
+        }
+
+        $expected = hash_hmac('sha256', $timestamp.'.'.$payload, $secret);
+
+        foreach ($signatures as $signature) {
+            if (hash_equals($expected, $signature)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+}

app/Http/Middleware/EnsureAdmin.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class EnsureAdmin
+{
+    /**
+     * Only operators with the console.view capability may reach the admin console.
+     * Legacy is_admin accounts are migrated to roles by the seed_roles_and_permissions
+     * migration and the seeder — the gate never trusts the bare is_admin flag, so
+     * an RBAC revocation is never silently undone here.
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        abort_unless((bool) $request->user()?->can('console.view'), 403);
+
+        return $next($request);
+    }
+}

app/Http/Middleware/EnsureCustomerActive.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Models\Customer;
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Enforce customer account lifecycle on portal requests: a suspended or closed
+ * customer must lose access. Admins are exempt, and an active impersonation
+ * session is exempt so operators can still inspect a suspended customer's portal.
+ */
+class EnsureCustomerActive
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        $user = $request->user();
+
+        if ($user !== null && ! $user->isOperator() && ! $request->session()->has('impersonator_id')) {
+            $customer = Customer::query()->where('user_id', $user->id)->first()
+                ?? Customer::query()->where('email', $user->email)->first();
+
+            if ($customer !== null && ($customer->status === 'suspended' || $customer->status === 'closed' || $customer->closed_at !== null)) {
+                Auth::logout();
+                $request->session()->invalidate();
+                $request->session()->regenerateToken();
+
+                $key = $customer->closed_at !== null || $customer->status === 'closed' ? 'auth.account_closed' : 'auth.account_suspended';
+
+                return redirect()->route('login')->withErrors(['email' => __($key)]);
+            }
+        }
+
+        return $next($request);
+    }
+}

app/Http/Middleware/PublicSiteGate.php

@@ -0,0 +1,68 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Support\Settings;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\IpUtils;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Hides the marketing site and the customer portal while the product is still
+ * being built, without hiding it from us.
+ *
+ * Switched from the console (site.public). Anyone coming through the management
+ * VPN, and any signed-in operator, sees the real thing; everyone else — crawlers
+ * included — gets a placeholder.
+ *
+ * Answers 503 with Retry-After and X-Robots-Tag rather than 200: a 200 would
+ * invite search engines to index the placeholder as the site's content, and
+ * getting that out of an index again is much harder than keeping it out.
+ */
+class PublicSiteGate
+{
+    /**
+     * Paths that must keep working regardless: the console itself (otherwise the
+     * switch could not be flipped back), Stripe's webhook, and the health check.
+     *
+     * Livewire is deliberately NOT in this list. Its endpoint is shared by the
+     * console and the portal, so exempting it would leave a signed-in customer
+     * able to drive portal components — including billing — while the portal is
+     * supposed to be offline. Operators pass the check below anyway, which is
+     * what the console actually needs.
+     *
+     * Nor is /login, and that has a consequence worth knowing before you hide
+     * the site: /admin sends a guest to /login, which is not the console, so
+     * SIGNING IN while hidden needs the request to come from a trusted range —
+     * the management VPN, or an address put in TRUSTED_RANGES for the initial
+     * setup. Exempting the login flow by hostname instead would mean trusting a
+     * Host header, which the caller chooses, and one forged header would unhide
+     * the entire portal.
+     */
+    private const ALWAYS_ALLOWED = ['admin', 'admin/*', 'webhooks/*', 'up', 'robots.txt'];
+
+    public function handle(Request $request, Closure $next): Response
+    {
+        if ($request->is(...self::ALWAYS_ALLOWED) || Settings::bool('site.public', true)) {
+            return $next($request);
+        }
+
+        if ($this->fromManagementNetwork($request) || $request->user()?->isOperator()) {
+            return $next($request);
+        }
+
+        return response()->view('coming-soon', [], 503)->withHeaders([
+            'Retry-After' => 3600,
+            'X-Robots-Tag' => 'noindex, nofollow, noarchive',
+            'Cache-Control' => 'no-store',
+        ]);
+    }
+
+    private function fromManagementNetwork(Request $request): bool
+    {
+        $ranges = (array) config('admin_access.trusted_ranges', []);
+
+        return $ranges !== [] && IpUtils::checkIp((string) $request->ip(), $ranges);
+    }
+}

app/Http/Middleware/RestrictAdminHost.php

@@ -0,0 +1,48 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Serves the operator console only on the hostnames listed in ADMIN_HOSTS.
+ *
+ * Responds 404 (not 403) on any other host: a public domain must not even
+ * disclose that an admin console exists here. Empty list = no restriction, so
+ * this can be rolled out without locking anyone out.
+ *
+ * Host-based rather than IP-based on purpose: behind a reverse proxy without
+ * TrustProxies, request->ip() is the proxy's address, so an IP allowlist would
+ * be misleading. The real network-level control stays in the proxy.
+ */
+class RestrictAdminHost
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        // Path-scoped and prepended to the `web` group rather than attached to
+        // the admin route group: route middleware is reordered by Laravel's
+        // priority list, which puts `auth` first — a guest would then be
+        // redirected to /login and thereby learn the console exists. Running
+        // ahead of the whole route stack makes the 404 deterministic.
+        if (! $request->is('admin', 'admin/*')) {
+            return $next($request);
+        }
+
+        // Lowercased here as well as in the config: DNS names are
+        // case-insensitive and getHost() always returns lowercase, so a
+        // capitalised ADMIN_HOSTS entry must not lock operators out — whatever
+        // route the value took into the config (env, cached config, runtime set).
+        $allowed = array_map(
+            fn ($host) => strtolower((string) $host),
+            (array) config('admin_access.hosts', []),
+        );
+
+        if ($allowed !== [] && ! in_array($request->getHost(), $allowed, true)) {
+            abort(404);
+        }
+
+        return $next($request);
+    }
+}

app/Livewire/Admin/ConfirmDeleteDatacenter.php

@@ -0,0 +1,60 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use App\Models\Datacenter;
+use App\Models\Host;
+use Illuminate\Database\QueryException;
+use LivewireUI\Modal\ModalComponent;
+
+/**
+ * Confirmation for deleting a datacenter (R5). Guarded: a datacenter that still
+ * has hosts cannot be deleted — it would orphan host placement — so the modal
+ * blocks and explains instead. Otherwise it is safe to hard-delete an unused code.
+ */
+class ConfirmDeleteDatacenter extends ModalComponent
+{
+    public string $uuid;
+
+    public string $name = '';
+
+    public int $hostCount = 0;
+
+    public function mount(string $uuid): void
+    {
+        $this->authorize('datacenters.manage'); // modals are reachable without the route middleware
+        $dc = Datacenter::query()->where('uuid', $uuid)->withCount('hosts')->firstOrFail();
+        $this->uuid = $uuid;
+        $this->name = $dc->name;
+        $this->hostCount = $dc->hosts_count;
+    }
+
+    public function delete()
+    {
+        $this->authorize('datacenters.manage');
+        $dc = Datacenter::query()->where('uuid', $this->uuid)->first();
+        if ($dc === null) {
+            return $this->redirectRoute('admin.datacenters', navigate: true);
+        }
+
+        // The hosts.datacenter → datacenters.code foreign key (restrictOnDelete)
+        // is the source of truth: the DB refuses to orphan a host. We pre-check
+        // for a friendly message and catch the constraint as the race backstop.
+        if (Host::query()->where('datacenter', $dc->code)->exists()) {
+            return $this->redirectRoute('admin.datacenters', navigate: true);
+        }
+
+        try {
+            $dc->delete();
+        } catch (QueryException) {
+            // A host was created for this code concurrently — leave it intact.
+        }
+
+        return $this->redirectRoute('admin.datacenters', navigate: true);
+    }
+
+    public function render()
+    {
+        return view('livewire.admin.confirm-delete-datacenter');
+    }
+}

app/Livewire/Admin/ConfirmDeletePlanDraft.php

@@ -0,0 +1,60 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use App\Models\PlanVersion;
+use App\Services\Billing\PlanCatalogue;
+use LivewireUI\Modal\ModalComponent;
+
+/**
+ * Confirmation for discarding an unpublished plan version.
+ *
+ * Only a draft can be discarded at all — a published version is what customers
+ * are contracted to, and the model refuses to delete one. So this is a small
+ * destructive action, and the modal says which one it is rather than leaving
+ * "delete" next to a row that might be either.
+ */
+class ConfirmDeletePlanDraft extends ModalComponent
+{
+    public string $uuid;
+
+    public int $version;
+
+    public string $plan = '';
+
+    public function mount(string $uuid): void
+    {
+        // Modals are reachable without the page's guards, so this is the real
+        // check, not a convenience one.
+        $this->authorize('plans.manage');
+
+        $version = PlanVersion::query()->with('family')->where('uuid', $uuid)->firstOrFail();
+        abort_if($version->isPublished(), 403);
+
+        $this->uuid = $uuid;
+        $this->version = $version->version;
+        $this->plan = $version->family->name;
+    }
+
+    public function delete(): void
+    {
+        $this->authorize('plans.manage');
+
+        $version = PlanVersion::query()->where('uuid', $this->uuid)->first();
+
+        // The catalogue decides, in one conditional statement. Checking here and
+        // deleting afterwards would leave a window in which the version is
+        // published between the two — and a published version must never go.
+        if ($version !== null && ! app(PlanCatalogue::class)->discardDraft($version)) {
+            $this->dispatch('notify', message: __('plans.discard_too_late'));
+        }
+
+        $this->dispatch('plan-draft-deleted');
+        $this->closeModal();
+    }
+
+    public function render()
+    {
+        return view('livewire.admin.confirm-delete-plan-draft');
+    }
+}

app/Livewire/Admin/ConfirmDeleteVpnPeer.php

@@ -0,0 +1,58 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use App\Models\VpnPeer;
+use App\Provisioning\Jobs\ApplyVpnPeer;
+use LivewireUI\Modal\ModalComponent;
+
+/**
+ * Confirmation for revoking a VPN access for good (R5). Deleting a peer that
+ * belongs to a host cuts CluPilot's own management path to that machine, so the
+ * modal says so plainly rather than hiding the option.
+ */
+class ConfirmDeleteVpnPeer extends ModalComponent
+{
+    public string $uuid;
+
+    public string $name = '';
+
+    public ?string $hostName = null;
+
+    public function mount(string $uuid): void
+    {
+        // Modals are reachable without the route middleware, so this is the
+        // real guard, not a convenience check.
+        $peer = VpnPeer::query()->with('host')->where('uuid', $uuid)->firstOrFail();
+        $this->authorize('delete', $peer);
+        $this->uuid = $uuid;
+        $this->name = $peer->name;
+        $this->hostName = $peer->host?->name;
+    }
+
+    public function delete(): void
+    {
+        $peer = VpnPeer::query()->where('uuid', $this->uuid)->first();
+        if ($peer !== null) {
+            $this->authorize('delete', $peer);
+
+            // A tombstone that still carries a usable private key is a liability.
+            $peer->purgeSecret();
+            // Soft-delete, so the row survives as a tombstone until the hub has
+            // actually dropped the peer. A hard delete here would let the next
+            // sync adopt the still-present peer back as a live access —
+            // silently restoring what was just revoked. ApplyVpnPeer purges the
+            // tombstone once removal succeeded; SyncVpnPeers retries if not.
+            $peer->delete();
+            ApplyVpnPeer::dispatch($peer->public_key, null, false);
+        }
+
+        $this->dispatch('vpn-peer-deleted');
+        $this->closeModal();
+    }
+
+    public function render()
+    {
+        return view('livewire.admin.confirm-delete-vpn-peer');
+    }
+}

app/Livewire/Admin/ConfirmRemoveHost.php

@@ -0,0 +1,46 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use App\Models\Host;
+use App\Provisioning\Jobs\PurgeHost;
+use LivewireUI\Modal\ModalComponent;
+
+/**
+ * Confirmation for the destructive "remove host" action (R5). Deregisters the
+ * CluPilot record only — it does not touch the physical server. The host is
+ * deactivated immediately and purged asynchronously so removal never blocks on
+ * (or races) an in-flight provisioning step.
+ */
+class ConfirmRemoveHost extends ModalComponent
+{
+    public string $uuid;
+
+    public string $name = '';
+
+    public function mount(string $uuid): void
+    {
+        $this->uuid = $uuid;
+        $this->name = Host::query()->where('uuid', $uuid)->value('name') ?? '';
+    }
+
+    public function remove()
+    {
+        $this->authorize('hosts.manage');
+        $host = Host::query()->where('uuid', $this->uuid)->first();
+
+        if ($host !== null) {
+            // Deactivate now (out of placement, visibly removed), finalize on the
+            // provisioning worker which waits for the runner lock.
+            $host->update(['status' => 'disabled']);
+            PurgeHost::dispatch($host->uuid);
+        }
+
+        return $this->redirectRoute('admin.hosts', navigate: true);
+    }
+
+    public function render()
+    {
+        return view('livewire.admin.confirm-remove-host');
+    }
+}

app/Livewire/Admin/Customers.php

@@ -0,0 +1,112 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use App\Models\Customer;
+use App\Models\PlanFamily;
+use App\Services\Billing\PlanCatalogue;
+use Illuminate\Support\Number;
+use Livewire\Attributes\Layout;
+use Livewire\Component;
+
+#[Layout('layouts.admin')]
+class Customers extends Component
+{
+    /** Suspend / reactivate a customer account (a guarded lifecycle action, not delete). */
+    public function toggleSuspend(string $uuid): void
+    {
+        $this->authorize('customers.manage');
+        $customer = Customer::query()->where('uuid', $uuid)->first();
+        if ($customer === null) {
+            return;
+        }
+
+        // A closed account is terminal — the suspend/reactivate toggle must not
+        // resurrect it to active while closed_at is still set.
+        if ($customer->closed_at !== null || $customer->status === 'closed') {
+            return;
+        }
+
+        $customer->update([
+            'status' => $customer->status === 'suspended' ? 'active' : 'suspended',
+        ]);
+
+        $this->dispatch('notify', message: __('admin.customer_'.($customer->status === 'suspended' ? 'suspended' : 'reactivated')));
+    }
+
+    public function render()
+    {
+        $locale = app()->getLocale();
+        $plans = app(PlanCatalogue::class)->sellable();
+
+        $customers = Customer::query()
+            ->with(['instances.subscription'])
+            ->orderBy('name')
+            ->get();
+
+        $rows = $customers->map(function (Customer $c) use ($plans, $locale) {
+            $instance = $c->instances->sortByDesc('id')->first();
+            $planKey = $instance->plan ?? null;
+            // What this customer actually pays, off their contract — not what
+            // the plan costs today. Otherwise a price rise inflates reported
+            // revenue for every grandfathered customer overnight.
+            //
+            // Per MONTH, whatever the term: a yearly contract stores the whole
+            // year, and adding that to a monthly column would report twelve
+            // times the revenue for anyone who paid up front.
+            $contract = $instance?->subscription;
+            $priceCents = (int) ($contract?->monthlyPriceCents()
+                ?? ($planKey !== null ? ($plans[$planKey]['price_cents'] ?? 0) : 0));
+
+            return [
+                'uuid' => $c->uuid,
+                'name' => $c->name,
+                'plan' => $planKey !== null ? __('billing.plan.'.$planKey) : '—',
+                'mrr' => Number::currency($priceCents / 100, in: 'EUR', locale: $locale),
+                'instance' => $instance->subdomain ?? '—',
+                // Only an instance that exists can hand out an admin login.
+                'instance_uuid' => ($instance?->status === 'active') ? $instance->uuid : null,
+                'closed' => $c->closed_at !== null || $c->status === 'closed',
+                'suspended' => $c->status === 'suspended',
+                'status' => match (true) {
+                    $c->closed_at !== null || $c->status === 'closed' => 'closed',
+                    $c->status === 'suspended' => 'suspended',
+                    default => $instance->status ?? $c->status ?? 'provisioning',
+                },
+            ];
+        })->all();
+
+        // Plan distribution for the doughnut — derived from live instances, and
+        // keyed by what customers are actually ON, not by what is on sale. A
+        // withdrawn plan still has customers, and dropping them from the chart
+        // would quietly understate the estate.
+        $labels = [];
+        $counts = [];
+        foreach (PlanFamily::query()->orderBy('tier')->pluck('key') as $planKey) {
+            $n = $customers->filter(fn (Customer $c) => $c->instances->contains('plan', $planKey))->count();
+            if ($n > 0) {
+                $labels[] = __('billing.plan.'.$planKey);
+                $counts[] = $n;
+            }
+        }
+
+        return view('livewire.admin.customers', [
+            'rows' => $rows,
+            'plansChart' => [
+                'type' => 'doughnut',
+                'data' => [
+                    'labels' => $labels,
+                    'datasets' => [[
+                        'data' => $counts,
+                        'backgroundColor' => ['token:info', 'token:accent', 'token:success-bright', 'token:warning'],
+                        'borderWidth' => 0,
+                    ]],
+                ],
+                'options' => [
+                    'cutout' => '62%',
+                    'plugins' => ['legend' => ['position' => 'bottom', 'labels' => ['boxWidth' => 10, 'padding' => 12]]],
+                ],
+            ],
+        ]);
+    }
+}

app/Livewire/Admin/Datacenters.php

@@ -0,0 +1,67 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use App\Models\Datacenter;
+use Illuminate\Validation\Rule;
+use Livewire\Attributes\Layout;
+use Livewire\Attributes\Validate;
+use Livewire\Component;
+
+#[Layout('layouts.admin')]
+class Datacenters extends Component
+{
+    #[Validate(['required', 'string', 'max:8', 'regex:/^[a-z0-9]([a-z0-9-]{0,6}[a-z0-9])?$/', 'unique:datacenters,code'])]
+    public string $code = '';
+
+    #[Validate('required|string|max:255')]
+    public string $name = '';
+
+    // Country picked from config/countries.php (no manual code typos).
+    #[Validate('nullable|string|max:2')]
+    public string $location = '';
+
+    public function save(): void
+    {
+        $this->authorize('datacenters.manage');
+        // Normalize before validating so the unique check matches how the row is
+        // stored — otherwise `FSN` passes the rule but the lowercased insert collides.
+        $this->code = strtolower(trim($this->code));
+
+        // Country must be one of the curated list — a forged request can bypass
+        // the <select>, so enforce membership server-side (mirrors EditDatacenter).
+        $data = $this->validate([
+            // A datacenter code becomes a DNS label (fsn-01.node.clupilot.com),
+            // so it has to be one: lowercase, no underscores, no leading or
+            // trailing dash.
+            'code' => ['required', 'string', 'max:8', 'regex:/^[a-z0-9]([a-z0-9-]{0,6}[a-z0-9])?$/', 'unique:datacenters,code'],
+            'name' => 'required|string|max:255',
+            'location' => ['nullable', Rule::in(array_keys((array) config('countries')))],
+        ]);
+
+        Datacenter::create([
+            'code' => $data['code'],
+            'name' => $data['name'],
+            'location' => $data['location'] ?: null,
+            'active' => true,
+        ]);
+
+        $this->reset('code', 'name', 'location');
+        $this->dispatch('notify', message: __('datacenters.created'));
+    }
+
+    public function toggle(string $uuid): void
+    {
+        $this->authorize('datacenters.manage');
+        $datacenter = Datacenter::query()->where('uuid', $uuid)->first();
+        $datacenter?->update(['active' => ! $datacenter->active]);
+    }
+
+    public function render()
+    {
+        return view('livewire.admin.datacenters', [
+            'datacenters' => Datacenter::query()->withCount('hosts')->orderBy('name')->get(),
+            'countries' => config('countries'),
+        ]);
+    }
+}

app/Livewire/Admin/EditDatacenter.php

@@ -0,0 +1,74 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use App\Models\Datacenter;
+use Illuminate\Validation\Rule;
+use Livewire\Attributes\Validate;
+use LivewireUI\Modal\ModalComponent;
+
+/**
+ * Edit a datacenter's name and location in a modal (avoids the row-height jump
+ * of inline editing). The code is immutable — it is referenced by hosts. Country
+ * is picked from a list so it can't be mistyped.
+ */
+class EditDatacenter extends ModalComponent
+{
+    public string $uuid = '';
+
+    public string $code = '';
+
+    #[Validate('required|string|max:255')]
+    public string $name = '';
+
+    public string $location = '';
+
+    /** The location present when the modal opened — a pre-curation free-form value. */
+    public string $originalLocation = '';
+
+    public function mount(string $uuid): void
+    {
+        $this->authorize('datacenters.manage'); // modals are reachable without the route middleware
+        $dc = Datacenter::query()->where('uuid', $uuid)->firstOrFail();
+        $this->uuid = $uuid;
+        $this->code = $dc->code;
+        $this->name = $dc->name;
+        $this->location = (string) $dc->location;
+        $this->originalLocation = (string) $dc->location;
+    }
+
+    public function save()
+    {
+        $this->authorize('datacenters.manage');
+
+        // Accept the configured countries plus the record's own legacy value, so a
+        // datacenter created before the curated list can still be edited. The
+        // legacy value is read from the DB — never from the client-hydrated
+        // property, which could be forged to whitelist an arbitrary location.
+        $dc = Datacenter::query()->where('uuid', $this->uuid)->firstOrFail();
+        $allowed = array_keys((array) config('countries'));
+        if ($dc->location) {
+            $allowed[] = $dc->location;
+        }
+        $data = $this->validate([
+            'name' => 'required|string|max:255',
+            'location' => ['nullable', Rule::in($allowed)], // array form — a legacy value may contain commas
+        ]);
+
+        Datacenter::query()->where('uuid', $this->uuid)->update([
+            'name' => $data['name'],
+            'location' => $data['location'] ?: null,
+        ]);
+
+        $this->dispatch('notify', message: __('datacenters.updated'));
+
+        return $this->redirectRoute('admin.datacenters', navigate: true);
+    }
+
+    public function render()
+    {
+        return view('livewire.admin.edit-datacenter', [
+            'countries' => config('countries'),
+        ]);
+    }
+}

app/Livewire/Admin/HostCreate.php

@@ -0,0 +1,46 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use App\Actions\StartHostOnboarding;
+use Livewire\Attributes\Layout;
+use Livewire\Attributes\Validate;
+use Livewire\Component;
+
+#[Layout('layouts.admin')]
+class HostCreate extends Component
+{
+    #[Validate('required|string|max:255')]
+    public string $name = '';
+
+    #[Validate('required|string|exists:datacenters,code,active,1')]
+    public string $datacenter = '';
+
+    public function mount(): void
+    {
+        $this->datacenter = (string) \App\Models\Datacenter::query()->active()->orderBy('name')->value('code');
+    }
+
+    #[Validate('required|ip|unique:hosts,public_ip')]
+    public string $public_ip = '';
+
+    #[Validate('required|string|min:8')]
+    public string $root_password = '';
+
+    public function save(StartHostOnboarding $action)
+    {
+        $this->authorize('hosts.manage');
+        $data = $this->validate();
+
+        $host = $action->run($data);
+
+        return $this->redirectRoute('admin.hosts.show', ['host' => $host->uuid], navigate: true);
+    }
+
+    public function render()
+    {
+        return view('livewire.admin.host-create', [
+            'datacenters' => \App\Models\Datacenter::query()->active()->orderBy('name')->get(),
+        ]);
+    }
+}

app/Livewire/Admin/HostDetail.php

@@ -0,0 +1,117 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use App\Models\Host;
+use App\Models\ProvisioningRun;
+use App\Provisioning\Jobs\AdvanceRunJob;
+use Illuminate\Support\Collection;
+use Livewire\Attributes\Layout;
+use Livewire\Attributes\On;
+use Livewire\Component;
+
+#[Layout('layouts.admin')]
+class HostDetail extends Component
+{
+    public Host $host;
+
+    public function mount(Host $host): void
+    {
+        $this->host = $host;
+    }
+
+    /** Live refresh whenever any run advances (admins-only channel). */
+    #[On('echo-private:admin.runs,StepAdvanced')]
+    public function onStepAdvanced(): void
+    {
+        $this->host->refresh();
+    }
+
+    /** Adjust the capacity reserve (% of storage kept free for headroom). */
+    public function saveReserve(int $reserve): void
+    {
+        $this->authorize('hosts.manage');
+        $reserve = max(0, min(90, $reserve));
+        $this->host->update(['reserve_pct' => $reserve]);
+        $this->dispatch('notify', message: __('hosts.detail.reserve_saved'));
+    }
+
+    /**
+     * Drain / return a host: toggle between active and disabled. Disabled takes
+     * it out of placement (maintenance) without purging it — distinct from the
+     * destructive "remove host". Never touches a host mid-onboarding.
+     */
+    public function toggleMaintenance(): void
+    {
+        $this->authorize('hosts.manage');
+        if ($this->host->status === 'active') {
+            $this->host->update(['status' => 'disabled']);
+        } elseif ($this->host->status === 'disabled') {
+            $this->host->update(['status' => 'active']);
+        }
+    }
+
+    public function retry(): void
+    {
+        $this->authorize('hosts.manage');
+        $run = $this->currentRun();
+
+        if ($run !== null && $run->status === ProvisioningRun::STATUS_FAILED) {
+            $run->update([
+                'status' => ProvisioningRun::STATUS_RUNNING,
+                'attempt' => 0,
+                'next_attempt_at' => now(),
+                'started_at' => now(), // reset the step timer so it doesn't re-time-out instantly
+                'error' => null,
+            ]);
+            $this->host->update(['status' => 'onboarding']);
+            AdvanceRunJob::dispatch($run->uuid);
+        }
+    }
+
+    private function currentRun(): ?ProvisioningRun
+    {
+        return $this->host->runs()->latest('id')->first();
+    }
+
+    /** @return array<int, array{label: string, state: string}> */
+    private function buildSteps(?ProvisioningRun $run): array
+    {
+        $pipeline = config('provisioning.pipelines.host', []);
+        $current = $run?->current_step ?? 0;
+        $status = $run?->status;
+
+        $steps = [];
+        foreach ($pipeline as $index => $class) {
+            if ($status === ProvisioningRun::STATUS_COMPLETED || $index < $current) {
+                $state = 'done';
+            } elseif ($index === $current) {
+                $state = $status === ProvisioningRun::STATUS_FAILED ? 'failed' : 'running';
+            } else {
+                $state = 'pending';
+            }
+
+            $steps[] = ['label' => __(app($class)->label()), 'state' => $state];
+        }
+
+        return $steps;
+    }
+
+    public function render()
+    {
+        $run = $this->currentRun();
+
+        /** @var Collection $events */
+        $events = $run
+            ? $run->events()->latest('id')->limit(30)->get()
+            : collect();
+
+        return view('livewire.admin.host-detail', [
+            'run' => $run,
+            'steps' => $this->buildSteps($run),
+            'events' => $events,
+            'instances' => $this->host->instances()->latest('id')->get(),
+            'health' => $this->host->healthState(),
+        ]);
+    }
+}

app/Livewire/Admin/Hosts.php

@@ -0,0 +1,53 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use App\Models\Datacenter;
+use App\Models\Host;
+use Livewire\Attributes\Layout;
+use Livewire\Attributes\Url;
+use Livewire\Component;
+
+#[Layout('layouts.admin')]
+class Hosts extends Component
+{
+    #[Url(as: 'q')]
+    public string $search = '';
+
+    #[Url]
+    public string $datacenter = '';
+
+    #[Url]
+    public string $status = '';
+
+    public function updated(): void
+    {
+        // no-op; keeps the query string in sync as filters change
+    }
+
+    public function clearFilters(): void
+    {
+        $this->reset('search', 'datacenter', 'status');
+    }
+
+    public function render()
+    {
+        $hosts = Host::query()
+            ->withCount('instances')
+            ->when($this->search !== '', function ($q) {
+                $term = '%'.$this->search.'%';
+                $q->where(fn ($w) => $w->where('name', 'like', $term)->orWhere('public_ip', 'like', $term));
+            })
+            ->when($this->datacenter !== '', fn ($q) => $q->where('datacenter', $this->datacenter))
+            ->when($this->status !== '', fn ($q) => $q->where('status', $this->status))
+            ->orderBy('datacenter')->orderBy('name')
+            ->get();
+
+        return view('livewire.admin.hosts', [
+            'hosts' => $hosts,
+            'datacenters' => Datacenter::query()->orderBy('name')->get(),
+            'statuses' => ['pending', 'onboarding', 'active', 'error', 'disabled'],
+            'total' => Host::query()->count(),
+        ]);
+    }
+}

app/Livewire/Admin/InstanceAdminAccess.php

@@ -0,0 +1,107 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use App\Models\Instance;
+use App\Provisioning\Jobs\IssueInstanceAdminAccess;
+use App\Services\Wireguard\ConfigHandoff;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\RateLimiter;
+use Illuminate\Support\Str;
+use LivewireUI\Modal\ModalComponent;
+
+/**
+ * Administrator access to a customer's Nextcloud.
+ *
+ * Not impersonation: that borrows a portal session. This resets our managed
+ * admin account inside the customer's installation and hands the credentials
+ * over once — the only thing stock Nextcloud offers, and honest about what it
+ * does rather than pretending to be a passwordless jump.
+ *
+ * The operator's own password is required, every time. Taking control of a
+ * customer's installation is not something an unattended browser should be able
+ * to do on its own.
+ */
+class InstanceAdminAccess extends ModalComponent
+{
+    public string $uuid;
+
+    public string $subdomain = '';
+
+    public string $password = '';
+
+    /** Opaque handle; the credentials never enter the component snapshot. */
+    public ?string $token = null;
+
+    public bool $waiting = false;
+
+    public function mount(string $uuid): void
+    {
+        $this->authorize('instances.adminlogin');
+
+        $instance = Instance::query()->where('uuid', $uuid)->firstOrFail();
+        $this->uuid = $uuid;
+        $this->subdomain = $instance->subdomain;
+    }
+
+    public function hydrate(): void
+    {
+        $this->authorize('instances.adminlogin');
+    }
+
+    public function request(): void
+    {
+        $this->authorize('instances.adminlogin');
+        $this->resetErrorBag('password');
+
+        $key = 'instance-admin:'.auth()->id();
+        if (RateLimiter::tooManyAttempts($key, 5)) {
+            $this->addError('password', __('instances.too_many_attempts', ['seconds' => RateLimiter::availableIn($key)]));
+
+            return;
+        }
+
+        if (! Hash::check($this->password, auth()->user()->password)) {
+            RateLimiter::hit($key, 300);
+            $this->addError('password', __('instances.wrong_password'));
+
+            return;
+        }
+
+        RateLimiter::clear($key);
+        $this->reset('password');
+
+        // The reset runs on the provisioning worker — it owns the tunnel. The
+        // token is where it will leave the result.
+        $this->token = Str::random(40);
+        $this->waiting = true;
+
+        IssueInstanceAdminAccess::dispatch($this->uuid, $this->token, (int) auth()->id());
+    }
+
+    public function render()
+    {
+        $payload = null;
+
+        if ($this->token !== null) {
+            $raw = ConfigHandoff::get($this->token);
+
+            if ($raw !== null) {
+                // Consumed on the first read: leaving it in the cache would make
+                // "shown once" a figure of speech — any replayed component
+                // request could fetch the password again for ten minutes. The
+                // payload lives in a local variable, so it reaches the view and
+                // nothing else.
+                ConfigHandoff::forget($this->token);
+                $this->token = null;
+                $this->waiting = false;
+                $payload = json_decode($raw, true);
+            }
+        }
+
+        return view('livewire.admin.instance-admin-access', [
+            'credentials' => isset($payload['password']) ? $payload : null,
+            'failed' => isset($payload['error']) ? $payload['error'] : null,
+        ]);
+    }
+}

app/Livewire/Admin/Instances.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use Livewire\Attributes\Layout;
+use Livewire\Component;
+
+#[Layout('layouts.admin')]
+class Instances extends Component
+{
+    public function render()
+    {
+        return view('livewire.admin.instances', [
+            'rows' => [
+                ['sub' => 'kanzlei-berger', 'host' => 'pve-fsn-1', 'vmid' => 1042, 'storage' => '235 / 500 GB', 'version' => 'NC 31.0.4', 'status' => 'active'],
+                ['sub' => 'stb-reiss', 'host' => 'pve-fsn-1', 'vmid' => 1051, 'storage' => '88 / 250 GB', 'version' => 'NC 31.0.4', 'status' => 'active'],
+                ['sub' => 'notariat-kuelz', 'host' => 'pve-fsn-2', 'vmid' => 1067, 'storage' => '612 / 1000 GB', 'version' => 'NC 31.0.4', 'status' => 'active'],
+                ['sub' => 'ordination-fux', 'host' => 'pve-fsn-2', 'vmid' => 1072, 'storage' => '2 / 100 GB', 'version' => 'NC 31.0.4', 'status' => 'provisioning'],
+                ['sub' => 'buero-lang', 'host' => 'pve-fsn-3', 'vmid' => 1074, 'storage' => '—', 'version' => 'NC 31.0.4', 'status' => 'provisioning'],
+                ['sub' => 'weingut-prantl', 'host' => 'pve-hel-1', 'vmid' => 1075, 'storage' => '4 / 100 GB', 'version' => 'NC 31.0.4', 'status' => 'provisioning'],
+                ['sub' => 'praxis-sommer', 'host' => 'pve-fsn-3', 'vmid' => 1039, 'storage' => '41 / 100 GB', 'version' => 'NC 31.0.4', 'status' => 'suspended'],
+            ],
+        ]);
+    }
+}

app/Livewire/Admin/Maintenance.php

@@ -0,0 +1,248 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use App\Models\Datacenter;
+use App\Models\Host;
+use App\Models\MaintenanceWindow;
+use App\Services\Maintenance\MaintenanceNotifier;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\DB;
+use Livewire\Attributes\Layout;
+use Livewire\Attributes\Validate;
+use Livewire\Component;
+
+#[Layout('layouts.admin')]
+class Maintenance extends Component
+{
+    #[Validate('required|string|max:255')]
+    public string $title = '';
+
+    #[Validate('nullable|string|max:2000')]
+    public string $publicDescription = '';
+
+    #[Validate('nullable|string|max:2000')]
+    public string $internalNotes = '';
+
+    #[Validate('required|date')]
+    public string $startsAt = '';
+
+    #[Validate('required|date')]
+    public string $endsAt = '';
+
+    /** @var array<int> */
+    public array $hostIds = [];
+
+    /** Toggle every host of one datacenter (select-all / deselect-all). */
+    public function selectDatacenter(string $code): void
+    {
+        $this->authorize('maintenance.manage');
+        $ids = Host::query()->where('datacenter', $code)->pluck('id')->map(fn ($id) => (string) $id)->all();
+        $current = array_map('strval', $this->hostIds);
+
+        $this->hostIds = empty(array_diff($ids, $current))
+            ? array_values(array_diff($current, $ids))   // all selected → clear them
+            : array_values(array_unique([...$current, ...$ids]));
+    }
+
+    /**
+     * Set the end from the start. Typing a full timestamp by hand is the
+     * fiddliest part of this form, and the end is almost always "start plus a
+     * round number of minutes".
+     */
+    public function setDuration(int $minutes): void
+    {
+        $this->authorize('maintenance.manage');
+
+        $start = $this->parsed($this->startsAt);
+        if ($start === null) {
+            // No start yet: assume the next half hour, which is what someone
+            // scheduling a window in a hurry means anyway.
+            $start = now()->addMinutes(30 - (now()->minute % 30))->startOfMinute();
+            $this->startsAt = $start->format('Y-m-d\TH:i');
+        }
+
+        $this->endsAt = $start->copy()->addMinutes($minutes)->format('Y-m-d\TH:i');
+    }
+
+    /** Minutes between start and end, or null while either is unusable. */
+    public function durationMinutes(): ?int
+    {
+        $start = $this->parsed($this->startsAt);
+        $end = $this->parsed($this->endsAt);
+
+        if ($start === null || $end === null || $end->lessThanOrEqualTo($start)) {
+            return null;
+        }
+
+        return (int) $start->diffInMinutes($end);
+    }
+
+    private function parsed(string $value): ?\Illuminate\Support\Carbon
+    {
+        if (trim($value) === '') {
+            return null;
+        }
+
+        try {
+            return \Illuminate\Support\Carbon::parse($value);
+        } catch (\Throwable) {
+            return null;   // half-typed input is normal while the field is live
+        }
+    }
+
+    public function saveDraft(): void
+    {
+        $this->authorize('maintenance.manage');
+        $this->persist('draft');
+    }
+
+    public function publish(): void
+    {
+        $this->authorize('maintenance.manage');
+        $window = $this->persist('scheduled');
+        if ($window !== null) {
+            app(MaintenanceNotifier::class)->announce($window);
+        }
+    }
+
+    private function persist(string $state): ?MaintenanceWindow
+    {
+        $data = $this->validate([
+            'title' => 'required|string|max:255',
+            'publicDescription' => 'nullable|string|max:2000',
+            'internalNotes' => 'nullable|string|max:2000',
+            'startsAt' => 'required|date',
+            'endsAt' => 'required|date',
+            'hostIds' => 'array',
+            'hostIds.*' => 'integer|exists:hosts,id',
+        ]);
+
+        $starts = Carbon::parse($data['startsAt']);
+        $ends = Carbon::parse($data['endsAt']);
+
+        if ($ends->lessThanOrEqualTo($starts)) {
+            $this->addError('endsAt', __('maintenance.end_after_start'));
+
+            return null;
+        }
+        // A window always needs a host — otherwise a hostless draft can never be
+        // published (there is no edit-hosts action) and is stuck.
+        if (empty($this->hostIds)) {
+            $this->addError('hostIds', __('maintenance.need_host'));
+
+            return null;
+        }
+        if ($state === 'scheduled' && $ends->isPast()) {
+            $this->addError('endsAt', __('maintenance.end_future'));
+
+            return null;
+        }
+
+        // Create the window and attach hosts atomically so a bad id can't leave
+        // an orphaned scheduled window behind.
+        $window = DB::transaction(function () use ($data, $starts, $ends, $state) {
+            $window = MaintenanceWindow::create([
+                'title' => $data['title'],
+                'public_description' => $data['publicDescription'] ?: null,
+                'internal_notes' => $data['internalNotes'] ?: null,
+                'starts_at' => $starts,
+                'ends_at' => $ends,
+                'state' => $state,
+                'created_by' => auth()->id(),
+                'published_at' => $state === 'scheduled' ? now() : null,
+            ]);
+            $window->hosts()->sync(array_map('intval', $data['hostIds'] ?? []));
+
+            return $window;
+        });
+
+        $this->reset('title', 'publicDescription', 'internalNotes', 'startsAt', 'endsAt', 'hostIds');
+        $this->dispatch('notify', message: __($state === 'scheduled' ? 'maintenance.published' : 'maintenance.draft_saved'));
+
+        return $window;
+    }
+
+    public function publishExisting(string $uuid): void
+    {
+        $this->authorize('maintenance.manage');
+        $window = MaintenanceWindow::query()->where('uuid', $uuid)->first();
+        if ($window === null || $window->state !== 'draft') {
+            return;
+        }
+        if ($window->hosts()->count() === 0 || $window->ends_at->isPast()) {
+            $this->dispatch('notify', message: __('maintenance.need_host'));
+
+            return;
+        }
+        $window->update(['state' => 'scheduled', 'published_at' => now()]);
+        app(MaintenanceNotifier::class)->announce($window);
+        $this->dispatch('notify', message: __('maintenance.published'));
+    }
+
+    /**
+     * Re-run announcements for a published window. Idempotent (ledger-guarded),
+     * so it only fills gaps — the retry path when a transient queue outage left
+     * some affected customers un-notified.
+     */
+    public function resend(string $uuid): void
+    {
+        $this->authorize('maintenance.manage');
+        $window = MaintenanceWindow::query()->where('uuid', $uuid)->first();
+        // Only announce for a window that has not yet ended (derived state).
+        if ($window === null || ! in_array($window->derivedState(), ['upcoming', 'active'], true)) {
+            return;
+        }
+        app(MaintenanceNotifier::class)->announce($window);
+        $this->dispatch('notify', message: __('maintenance.notified'));
+    }
+
+    public function cancel(string $uuid): void
+    {
+        $this->authorize('maintenance.manage');
+        $window = MaintenanceWindow::query()->where('uuid', $uuid)->first();
+        // Cannot cancel what is already cancelled or has already completed.
+        if ($window === null || in_array($window->derivedState(), ['cancelled', 'completed'], true)) {
+            return;
+        }
+        $wasPublished = $window->state === 'scheduled';
+        $window->update(['state' => 'cancelled', 'cancelled_at' => now()]);
+
+        // Customers who received an announcement are told it's cancelled. The
+        // MessageSending listener suppresses still-pending announcements, and the
+        // MessageSent listener catches the race (an announcement that delivers
+        // just as we cancel) by queuing a catch-up cancellation for it.
+        if ($wasPublished) {
+            app(MaintenanceNotifier::class)->notifyCancellation($window);
+        }
+
+        $this->dispatch('notify', message: __('maintenance.cancelled'));
+    }
+
+    public function render()
+    {
+        $windows = MaintenanceWindow::query()
+            ->withCount('hosts')
+            ->orderByDesc('starts_at')
+            ->get()
+            ->map(fn (MaintenanceWindow $w) => [
+                'uuid' => $w->uuid,
+                'title' => $w->title,
+                'starts_at' => $w->starts_at,
+                'ends_at' => $w->ends_at,
+                'state' => $w->derivedState(),
+                'hosts' => $w->hosts_count,
+                'affected' => $w->affectedCustomers()->count(),
+                'is_draft' => $w->state === 'draft',
+                'notifiable' => $w->state === 'scheduled' && in_array($w->derivedState(), ['upcoming', 'active'], true),
+                'cancellable' => in_array($w->derivedState(), ['draft', 'upcoming', 'active'], true),
+            ]);
+
+        return view('livewire.admin.maintenance', [
+            'windows' => $windows,
+            'datacenters' => Datacenter::query()->orderBy('name')->get(),
+            'hosts' => Host::query()->orderBy('datacenter')->orderBy('name')->get(),
+            'durationMinutes' => $this->durationMinutes(),
+        ]);
+    }
+}

app/Livewire/Admin/Overview.php

@@ -0,0 +1,82 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Number;
+use Livewire\Attributes\Layout;
+use Livewire\Component;
+
+#[Layout('layouts.admin')]
+class Overview extends Component
+{
+    public function render()
+    {
+        $locale = app()->getLocale();
+        $months = collect(range(11, 0))
+            ->map(fn ($i) => Carbon::now()->locale($locale)->startOfMonth()->subMonths($i)->isoFormat('MMM'))
+            ->all();
+
+        return view('livewire.admin.overview', [
+            'kpis' => [
+                ['label' => __('admin.kpi.customers'), 'value' => '42', 'delta' => '+3', 'tone' => 'success'],
+                ['label' => __('admin.kpi.instances'), 'value' => '39', 'sub' => __('admin.kpi.instances_sub'), 'tone' => 'success'],
+                ['label' => __('admin.kpi.hosts'), 'value' => '4', 'sub' => __('admin.kpi.hosts_sub'), 'tone' => 'muted'],
+                ['label' => __('admin.kpi.mrr'), 'value' => Number::currency(7842, in: 'EUR', locale: $locale), 'delta' => '+6,2 %', 'tone' => 'success'],
+            ],
+            'fleetChart' => [
+                'type' => 'line',
+                'data' => [
+                    'labels' => $months,
+                    'datasets' => [[
+                        'label' => __('admin.kpi.instances'),
+                        'data' => [21, 23, 25, 27, 28, 30, 31, 33, 35, 36, 38, 39],
+                        'borderColor' => 'token:accent',
+                        'backgroundColor' => 'token:accent/0.12',
+                        'fill' => true, 'tension' => 0.35, 'pointRadius' => 0, 'borderWidth' => 2,
+                    ]],
+                ],
+                'options' => [
+                    'scales' => ['x' => ['grid' => ['display' => false]], 'y' => ['grid' => ['color' => 'token:border']]],
+                    'plugins' => ['legend' => ['display' => false]],
+                ],
+            ],
+            'revenueChart' => [
+                'type' => 'line',
+                'data' => [
+                    'labels' => $months,
+                    'datasets' => [[
+                        'label' => 'MRR',
+                        'data' => [4100, 4460, 4900, 5300, 5600, 6050, 6300, 6700, 7050, 7300, 7620, 7842],
+                        'borderColor' => 'token:accent',
+                        'fill' => true,
+                        'tension' => 0.35,
+                        'pointRadius' => 0,
+                        'borderWidth' => 2,
+                    ]],
+                ],
+                'options' => [
+                    'scales' => ['x' => ['grid' => ['display' => false]], 'y' => ['beginAtZero' => true, 'grid' => ['color' => 'token:border']]],
+                    'plugins' => ['legend' => ['display' => false]],
+                ],
+            ],
+            // Per-host storage load as capacity meters (a ranked comparison, not a
+            // trend — so meters, not a chart). level drives the meter colour.
+            'hostLoad' => [
+                ['name' => 'pve-fsn-1', 'pct' => 72, 'level' => 'warn'],
+                ['name' => 'pve-fsn-2', 'pct' => 64, 'level' => 'ok'],
+                ['name' => 'pve-fsn-3', 'pct' => 81, 'level' => 'high'],
+                ['name' => 'pve-hel-1', 'pct' => 38, 'level' => 'ok'],
+            ],
+            'runs' => [
+                ['customer' => 'Ordination Dr. Fux', 'step' => __('admin.run.deploy'), 'state' => 'running'],
+                ['customer' => 'Architekturbüro Lang', 'step' => __('admin.run.dns'), 'state' => 'running'],
+                ['customer' => 'Weingut Prantl', 'step' => __('admin.run.acceptance'), 'state' => 'running'],
+            ],
+            'alerts' => [
+                ['level' => 'warning', 'text' => __('admin.alert.host_load', ['host' => 'pve-fsn-3'])],
+                ['level' => 'info', 'text' => __('admin.alert.cert_soon', ['n' => 3])],
+            ],
+        ]);
+    }
+}

app/Livewire/Admin/PlanVersions.php

@@ -0,0 +1,243 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use App\Models\PlanFamily;
+use App\Models\PlanVersion;
+use App\Models\Subscription;
+use App\Services\Billing\PlanCatalogue;
+use Illuminate\Support\Carbon;
+use Illuminate\Validation\Rule;
+use Livewire\Attributes\Layout;
+use Livewire\Attributes\On;
+use Livewire\Component;
+use RuntimeException;
+
+/**
+ * The versions of one plan: what it can do, what it costs, and when it sells.
+ *
+ * The page is built around the one rule that matters here — a draft can be
+ * edited freely, a published version cannot be touched at all. So drafting and
+ * publishing are separate acts, and publishing says plainly that it is final.
+ */
+#[Layout('layouts.admin')]
+class PlanVersions extends Component
+{
+    public string $uuid;
+
+    /** The draft being written. */
+    public int $quotaGb = 100;
+
+    public int $trafficGb = 1000;
+
+    public int $seats = 5;
+
+    public int $ramMb = 4096;
+
+    public int $cores = 2;
+
+    public int $diskGb = 120;
+
+    public string $performance = 'standard';
+
+    public ?int $templateVmid = 9000;
+
+    /** @var array<int, string> */
+    public array $features = [];
+
+    public int $monthlyCents = 4900;
+
+    public int $yearlyCents = 58800;
+
+    /** Publishing: when it goes on sale, and optionally when it stops. */
+    public string $availableFrom = '';
+
+    public string $availableUntil = '';
+
+    public ?string $publishing = null;
+
+    public function mount(string $uuid): void
+    {
+        $this->authorize('plans.manage');
+
+        $family = PlanFamily::query()->where('uuid', $uuid)->firstOrFail();
+        $this->uuid = $uuid;
+
+        // Start the draft from what this plan is today, so the common case —
+        // "same plan, new price" — is a single edit rather than nine.
+        $latest = $family->versions()->orderByDesc('version')->first();
+
+        if ($latest !== null) {
+            $this->quotaGb = $latest->quota_gb;
+            $this->trafficGb = $latest->traffic_gb;
+            $this->seats = $latest->seats;
+            $this->ramMb = $latest->ram_mb;
+            $this->cores = $latest->cores;
+            $this->diskGb = $latest->disk_gb;
+            $this->performance = (string) ($latest->performance ?? 'standard');
+            $this->templateVmid = $latest->template_vmid;
+            $this->features = $latest->features ?? [];
+
+            $monthly = $latest->priceFor(Subscription::TERM_MONTHLY);
+            $yearly = $latest->priceFor(Subscription::TERM_YEARLY);
+            $this->monthlyCents = $monthly?->amount_cents ?? $this->monthlyCents;
+            $this->yearlyCents = $yearly?->amount_cents ?? $this->yearlyCents;
+        }
+    }
+
+    private function family(): PlanFamily
+    {
+        return PlanFamily::query()->where('uuid', $this->uuid)->firstOrFail();
+    }
+
+    /** Write a new draft. Nothing is promised until it is published. */
+    public function draft(): void
+    {
+        $this->authorize('plans.manage');
+
+        // Every bound is explicit, and generous rather than tight. A mistyped
+        // figure has to come back as a message on the field; without an upper
+        // limit it overflows the column instead and the owner gets a 500 with
+        // no idea which number was wrong.
+        $data = $this->validate([
+            'quotaGb' => 'required|integer|min:1|max:1000000',
+            'trafficGb' => 'required|integer|min:0|max:10000000',
+            'seats' => 'required|integer|min:1|max:100000',
+            'ramMb' => 'required|integer|min:512|max:4194304',
+            'cores' => 'required|integer|min:1|max:512',
+            // The disk has to hold the customer's quota plus the system itself.
+            'diskGb' => 'required|integer|min:1|max:1000000|gte:quotaGb',
+            // One of the classes we actually have a label for. Free text means
+            // a typo is published, frozen, and shown to customers forever as a
+            // raw translation key.
+            'performance' => ['required', Rule::in(array_keys((array) __('billing.perf')))],
+            // Required, not nullable: a version without a blueprint can be
+            // published and sold, and then fails provisioning every time.
+            'templateVmid' => 'required|integer|min:100|max:999999999',
+            'features' => 'array',
+            // Same reason as the performance class: a request can carry
+            // anything, and an unknown key is frozen at publication and shown
+            // to customers as a raw translation key.
+            'features.*' => ['string', Rule::in(array_keys((array) __('billing.feature')))],
+            // 9,999,999.99 in the catalogue currency — far past anything we
+            // would charge, far short of overflowing an unsigned int.
+            'monthlyCents' => 'required|integer|min:0|max:999999999',
+            'yearlyCents' => 'required|integer|min:0|max:999999999',
+        ]);
+
+        $version = app(PlanCatalogue::class)->draft(
+            $this->family(),
+            [
+                'quota_gb' => $data['quotaGb'],
+                'traffic_gb' => $data['trafficGb'],
+                'seats' => $data['seats'],
+                'ram_mb' => $data['ramMb'],
+                'cores' => $data['cores'],
+                'disk_gb' => $data['diskGb'],
+                'performance' => $data['performance'],
+                'template_vmid' => $data['templateVmid'],
+                'features' => array_values($data['features']),
+            ],
+            // Both terms, because publishing refuses a version that is not
+            // priced for each — better to find that out here than in front of
+            // a customer.
+            [
+                Subscription::TERM_MONTHLY => $data['monthlyCents'],
+                Subscription::TERM_YEARLY => $data['yearlyCents'],
+            ],
+        );
+
+        $this->dispatch('notify', message: __('plans.draft_created', ['version' => $version->version]));
+    }
+
+    /** Open the publish form for one draft. */
+    public function choose(string $versionUuid): void
+    {
+        $this->publishing = $versionUuid;
+        $this->availableFrom = now()->format('Y-m-d\TH:i');
+        $this->availableUntil = '';
+    }
+
+    public function cancelPublish(): void
+    {
+        $this->reset('publishing', 'availableFrom', 'availableUntil');
+    }
+
+    /**
+     * Publish: fix the terms and put them on sale.
+     *
+     * Everything that can refuse this — an unpriced version, a window that
+     * overlaps another — refuses before anything is written, so a rejected
+     * publish leaves an editable draft rather than a stranded one.
+     */
+    public function publish(): void
+    {
+        $this->authorize('plans.manage');
+
+        $this->validate([
+            'availableFrom' => 'required|date',
+            'availableUntil' => 'nullable|date|after:availableFrom',
+        ]);
+
+        $version = PlanVersion::query()->where('uuid', $this->publishing)->firstOrFail();
+        abort_unless($version->plan_family_id === $this->family()->id, 404);
+
+        try {
+            app(PlanCatalogue::class)->publish(
+                $version,
+                Carbon::parse($this->availableFrom),
+                $this->availableUntil !== '' ? Carbon::parse($this->availableUntil) : null,
+            );
+        } catch (RuntimeException $e) {
+            $this->addError('availableFrom', $e->getMessage());
+
+            return;
+        }
+
+        $this->cancelPublish();
+        $this->dispatch('notify', message: __('plans.published', ['version' => $version->version]));
+    }
+
+    /**
+     * Close a running version's window — the ordinary way to take a plan off
+     * sale for good, since a published version can never be deleted.
+     */
+    public function close(string $versionUuid): void
+    {
+        $this->authorize('plans.manage');
+
+        $version = PlanVersion::query()->where('uuid', $versionUuid)->firstOrFail();
+        abort_unless($version->plan_family_id === $this->family()->id, 404);
+
+        try {
+            app(PlanCatalogue::class)->schedule($version, $version->available_from, now());
+        } catch (RuntimeException $e) {
+            $this->addError('availableFrom', $e->getMessage());
+
+            return;
+        }
+
+        $this->dispatch('notify', message: __('plans.closed', ['version' => $version->version]));
+    }
+
+    #[On('plan-draft-deleted')]
+    public function refresh(): void
+    {
+        // Livewire re-renders; the listener exists so the modal can say so.
+    }
+
+    public function render()
+    {
+        $family = $this->family();
+        $now = now();
+
+        return view('livewire.admin.plan-versions', [
+            'family' => $family,
+            'versions' => $family->versions()->with('prices')->orderByDesc('version')->get(),
+            'now' => $now,
+            'featureKeys' => array_keys((array) __('billing.feature')),
+            'performanceClasses' => (array) __('billing.perf'),
+            'currency' => Subscription::catalogueCurrency(),
+        ]);
+    }
+}

app/Livewire/Admin/Plans.php

@@ -0,0 +1,116 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use App\Models\PlanFamily;
+use App\Services\Billing\PlanCatalogue;
+use Livewire\Attributes\Layout;
+use Livewire\Attributes\Validate;
+use Livewire\Component;
+
+/**
+ * The plan lines we sell, and whether each is currently on sale.
+ *
+ * Deliberately shallow: a family is a name and a rank, and everything that can
+ * be got wrong — capabilities, prices, windows — lives one level down on the
+ * versions, where publishing makes it permanent.
+ */
+#[Layout('layouts.admin')]
+class Plans extends Component
+{
+    #[Validate(['required', 'string', 'max:32', 'regex:/^[a-z][a-z0-9_]*$/', 'unique:plan_families,key'])]
+    public string $key = '';
+
+    #[Validate('required|string|max:255')]
+    public string $name = '';
+
+    #[Validate('required|integer|min:0|max:255')]
+    public int $tier = 1;
+
+    public function mount(): void
+    {
+        // The page itself, not only its buttons. Hiding the nav entry and
+        // guarding the mutations still leaves the whole catalogue — prices,
+        // drafts, unreleased plans — readable to any operator who types the URL.
+        $this->authorize('plans.manage');
+    }
+
+    public function save(): void
+    {
+        $this->authorize('plans.manage');
+
+        $this->key = strtolower(trim($this->key));
+
+        $data = $this->validate([
+            // The key is permanent once created — orders, instances and every
+            // contract snapshot store it as a string — so it has to be a plain
+            // identifier, not something anyone will want to prettify later.
+            'key' => ['required', 'string', 'max:32', 'regex:/^[a-z][a-z0-9_]*$/', 'unique:plan_families,key'],
+            'name' => 'required|string|max:255',
+            'tier' => 'required|integer|min:0|max:255',
+        ]);
+
+        PlanFamily::create([
+            'key' => $data['key'],
+            'name' => $data['name'],
+            'tier' => $data['tier'],
+            // Nothing to sell until a version is published, so it starts able
+            // to sell and simply has nothing available.
+            'sales_enabled' => true,
+        ]);
+
+        $this->reset('key', 'name', 'tier');
+        $this->tier = 1;
+        $this->dispatch('notify', message: __('plans.created'));
+    }
+
+    /**
+     * The kill switch: stop selling this plan now, without touching a window.
+     *
+     * Existing customers keep their contract and their machine — this only
+     * decides whether anyone new can buy it.
+     */
+    public function toggleSales(string $uuid): void
+    {
+        $this->authorize('plans.manage');
+
+        $family = PlanFamily::query()->where('uuid', $uuid)->first();
+        $family?->update(['sales_enabled' => ! $family->sales_enabled]);
+
+        $this->dispatch('notify', message: __($family?->sales_enabled ? 'plans.now_selling' : 'plans.withdrawn'));
+    }
+
+    public function render()
+    {
+        $now = now();
+
+        $families = PlanFamily::query()
+            ->with(['versions.prices'])
+            ->withCount('versions')
+            ->orderBy('tier')
+            ->get()
+            ->map(fn (PlanFamily $family) => [
+                'uuid' => $family->uuid,
+                'key' => $family->key,
+                'name' => $family->name,
+                'tier' => $family->tier,
+                'sales_enabled' => $family->sales_enabled,
+                'versions_count' => $family->versions_count,
+                'live' => $family->versions->first(fn ($v) => $v->isAvailableAt($now)),
+                // What is queued up next, so a scheduled launch is visible
+                // before a customer discovers it.
+                'next' => $family->versions
+                    ->filter(fn ($v) => $v->isPublished() && $v->available_from->greaterThan($now))
+                    ->sortBy('available_from')
+                    ->first(),
+                'drafts' => $family->versions->filter(fn ($v) => ! $v->isPublished())->count(),
+            ]);
+
+        return view('livewire.admin.plans', [
+            'families' => $families,
+            // The shop's own answer, so this page cannot disagree with what a
+            // customer actually sees.
+            'sellable' => array_keys(app(PlanCatalogue::class)->sellable()),
+        ]);
+    }
+}

app/Livewire/Admin/Provisioning.php

@@ -0,0 +1,160 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use App\Livewire\Concerns\BuildsRunSteps;
+use App\Models\Host;
+use App\Models\Instance;
+use App\Models\Order;
+use App\Models\ProvisioningRun;
+use App\Provisioning\Jobs\AdvanceRunJob;
+use Livewire\Attributes\Layout;
+use Livewire\Attributes\On;
+use Livewire\Component;
+
+#[Layout('layouts.admin')]
+class Provisioning extends Component
+{
+    use BuildsRunSteps;
+
+    #[On('echo-private:admin.runs,StepAdvanced')]
+    public function onStepAdvanced(): void
+    {
+        // A round-trip re-renders with fresh run state.
+    }
+
+    /** Retry a failed run from its current step (mirrors the host-detail retry). */
+    public function retry(string $uuid): void
+    {
+        $this->authorize('provisioning.retry');
+        // Atomically claim the run: only the request that transitions it out of
+        // FAILED proceeds, so two concurrent retries can't double-dispatch.
+        $claimed = ProvisioningRun::query()
+            ->where('uuid', $uuid)
+            ->where('status', ProvisioningRun::STATUS_FAILED)
+            ->update([
+                'status' => ProvisioningRun::STATUS_RUNNING,
+                'attempt' => 0,
+                'next_attempt_at' => now(),
+                'started_at' => now(), // reset the step timer so it doesn't re-time-out instantly
+                'error' => null,
+            ]);
+        if ($claimed === 0) {
+            return; // already retried by a concurrent request
+        }
+        $run = ProvisioningRun::query()->where('uuid', $uuid)->first();
+        if ($run === null) {
+            return;
+        }
+
+        // Move the subject out of its error state so the console reflects the retry.
+        $subject = $run->subject;
+        if ($subject instanceof Host) {
+            $subject->update(['status' => 'onboarding']);
+        } elseif ($subject instanceof Order) {
+            $subject->update(['status' => 'provisioning']);
+            Instance::query()->where('order_id', $subject->id)->where('status', 'failed')->update(['status' => 'provisioning']);
+        }
+
+        AdvanceRunJob::dispatch($run->uuid);
+        $this->dispatch('notify', message: __('admin.run_retried'));
+    }
+
+    /**
+     * A run that claims to be in progress but hasn't advanced in a while looks
+     * stuck — unless it is in a legitimate scheduled backoff (next_attempt_at in
+     * the future, e.g. RunRunner's retry delay of up to 300 s).
+     */
+    private function isStale(ProvisioningRun $run): bool
+    {
+        if (! in_array($run->status, ['running', 'waiting'], true)) {
+            return false;
+        }
+        if ($run->next_attempt_at !== null && $run->next_attempt_at->isFuture()) {
+            return false; // waiting out a scheduled retry/poll — not stuck
+        }
+
+        // Compare against the CURRENT step's own allowed duration — some steps
+        // (VM clone, Proxmox install) legitimately run for many minutes — plus a
+        // small grace. Only past its own deadline without advancing is it stuck.
+        $pipeline = config('provisioning.pipelines.'.$run->pipeline, []);
+        $class = $pipeline[$run->current_step] ?? null;
+        $maxSeconds = $class !== null ? app($class)->maxDuration() : 120;
+
+        return $run->updated_at !== null && $run->updated_at->lt(now()->subSeconds($maxSeconds + 30));
+    }
+
+    private function subjectLabel(ProvisioningRun $run): string
+    {
+        $subject = $run->subject;
+
+        if ($subject instanceof Order) {
+            return $subject->customer?->name ?? 'Order';
+        }
+        if ($subject instanceof Host) {
+            return $subject->name;
+        }
+
+        return class_basename($run->subject_type);
+    }
+
+    public function render()
+    {
+        $runs = ProvisioningRun::query()->latest('id')->limit(30)->get();
+
+        $active = $runs->first(fn (ProvisioningRun $r) => in_array(
+            $r->status, ['pending', 'running', 'waiting'], true
+        )) ?? $runs->first();
+
+        return view('livewire.admin.provisioning', [
+            'hasActive' => $active !== null && in_array($active->status, ['pending', 'running', 'waiting'], true),
+            'rows' => $runs->map(function (ProvisioningRun $r) {
+                $total = max(count(config('provisioning.pipelines.'.$r->pipeline, [])), 1);
+                $done = $r->status === ProvisioningRun::STATUS_COMPLETED ? $total : $r->current_step;
+
+                return [
+                    'uuid' => $r->uuid,
+                    'customer' => $this->subjectLabel($r),
+                    'pipeline' => $r->pipeline,
+                    'step' => $r->status === 'completed' ? '—' : $this->currentStepLabel($r),
+                    'n' => ($r->current_step + 1).'/'.$total,
+                    'percent' => (int) round($done / $total * 100),
+                    'attempt' => $r->attempt,
+                    'state' => $this->runState($r),
+                    'failed' => $r->status === ProvisioningRun::STATUS_FAILED,
+                    'activity' => $r->updated_at?->diffForHumans() ?? '—',
+                    'stale' => $this->isStale($r),
+                ];
+            })->all(),
+            'panel' => $active ? $this->panelFor($active) : null,
+        ]);
+    }
+
+    /** Compact "current run" readout for the right column. */
+    private function panelFor(ProvisioningRun $run): array
+    {
+        $pipeline = config('provisioning.pipelines.'.$run->pipeline, []);
+        $total = max(count($pipeline), 1);
+        $current = min($run->current_step, $total - 1);
+        $completed = $run->status === ProvisioningRun::STATUS_COMPLETED;
+        $done = $completed ? $total : $current;
+
+        return [
+            'uuid' => $run->uuid,
+            'subject' => $this->subjectLabel($run),
+            'pipeline' => $run->pipeline,
+            'attempt' => $run->attempt,
+            'status' => $this->runState($run),                       // running|done|failed
+            'failed' => $run->status === ProvisioningRun::STATUS_FAILED,
+            'current' => $completed ? null : (isset($pipeline[$current]) ? __(app($pipeline[$current])->label()) : null),
+            'next' => isset($pipeline[$current + 1]) && ! $completed ? __(app($pipeline[$current + 1])->label()) : null,
+            'error' => $run->error,
+            'done' => $done,
+            'total' => $total,
+            'percent' => (int) round($done / $total * 100),
+            'activity' => $run->updated_at?->diffForHumans() ?? '—',
+            'started' => $run->started_at?->diffForHumans() ?? null,
+            'stale' => $this->isStale($run),
+        ];
+    }
+}

app/Livewire/Admin/Revenue.php

@@ -0,0 +1,64 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Number;
+use Livewire\Attributes\Layout;
+use Livewire\Component;
+
+#[Layout('layouts.admin')]
+class Revenue extends Component
+{
+    public function render()
+    {
+        $locale = app()->getLocale();
+        $eur = fn (int $v) => Number::currency($v, in: 'EUR', locale: $locale);
+        $months = collect(range(11, 0))
+            ->map(fn ($i) => Carbon::now()->locale($locale)->startOfMonth()->subMonths($i)->isoFormat('MMM'))
+            ->all();
+
+        return view('livewire.admin.revenue', [
+            'kpis' => [
+                ['label' => __('admin.rev.mrr'), 'value' => $eur(7842), 'delta' => '+6,2 %'],
+                ['label' => __('admin.rev.arr'), 'value' => $eur(94104), 'delta' => '+18 %'],
+                ['label' => __('admin.rev.arpu'), 'value' => $eur(187), 'delta' => '+1,4 %'],
+                ['label' => __('admin.rev.churn'), 'value' => '1,8 %', 'delta' => '−0,3 %'],
+            ],
+            'mrrChart' => [
+                'type' => 'line',
+                'data' => [
+                    'labels' => $months,
+                    'datasets' => [[
+                        'label' => 'MRR',
+                        'data' => [4100, 4460, 4900, 5300, 5600, 6050, 6300, 6700, 7050, 7300, 7620, 7842],
+                        'borderColor' => 'token:accent', 'backgroundColor' => 'token:accent/0.12',
+                        'fill' => true, 'tension' => 0.35, 'pointRadius' => 0, 'borderWidth' => 2,
+                    ]],
+                ],
+                'options' => [
+                    'scales' => ['x' => ['grid' => ['display' => false]], 'y' => ['grid' => ['color' => 'token:border']]],
+                    'plugins' => ['legend' => ['display' => false]],
+                ],
+            ],
+            'planChart' => [
+                'type' => 'doughnut',
+                'data' => [
+                    'labels' => ['Solo', 'Team', 'Enterprise'],
+                    'datasets' => [[
+                        'data' => [1659, 3366, 1796],
+                        'backgroundColor' => ['token:info', 'token:accent', 'token:success-bright'],
+                        'borderWidth' => 0,
+                    ]],
+                ],
+                'options' => ['cutout' => '62%', 'plugins' => ['legend' => ['position' => 'bottom', 'labels' => ['boxWidth' => 10, 'padding' => 12]]]],
+            ],
+            'payments' => [
+                ['customer' => 'Notariat Külz', 'amount' => $eur(449), 'when' => '01.07.'],
+                ['customer' => 'Kanzlei Berger', 'amount' => $eur(198), 'when' => '01.07.'],
+                ['customer' => 'Steuerberatung Reiss', 'amount' => $eur(198), 'when' => '01.07.'],
+                ['customer' => 'Ordination Dr. Fux', 'amount' => $eur(79), 'when' => '30.06.'],
+            ],
+        ]);
+    }
+}

app/Livewire/Admin/Settings.php

@@ -0,0 +1,267 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use App\Models\Customer;
+use App\Models\User;
+use App\Models\VpnPeer;
+use App\Support\Settings as AppSettings;
+use App\Provisioning\Jobs\ApplyVpnPeer;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Str;
+use Spatie\Permission\Models\Role;
+use Livewire\Attributes\Layout;
+use Livewire\Attributes\Validate;
+use Livewire\Component;
+
+/**
+ * Operator settings: the signed-in operator's own account plus (Owner-only)
+ * staff management. All staff mutations are capability-gated server-side and
+ * protect the last-Owner and self-role invariants transactionally.
+ */
+#[Layout('layouts.admin')]
+class Settings extends Component
+{
+    // My account
+    #[Validate('required|string|max:255')]
+    public string $name = '';
+
+    #[Validate('required|email|max:255')]
+    public string $email = '';
+
+    // Invite staff
+    #[Validate('required|string|max:255')]
+    public string $staffName = '';
+
+    #[Validate('required|email|max:255')]
+    public string $staffEmail = '';
+
+    #[Validate('required|in:Owner,Admin,Support,Billing,Read-only')]
+    public string $staffRole = 'Support';
+
+    /** Shown once after inviting, since email delivery is still mocked. */
+    public ?string $invitedEmail = null;
+
+    public ?string $invitedPassword = null;
+
+    public function mount(): void
+    {
+        $this->name = auth()->user()->name;
+        $this->email = auth()->user()->email;
+    }
+
+    /**
+     * Take the marketing site and the customer portal offline, or back online.
+     * The console keeps working either way — otherwise this switch could only
+     * ever be flipped once.
+     */
+    public function toggleSiteVisibility(): void
+    {
+        $this->authorize('site.manage');
+
+        $public = ! AppSettings::bool('site.public', true);
+        AppSettings::set('site.public', $public);
+
+        $this->dispatch('notify', message: $public
+            ? __('admin_settings.site_now_public')
+            : __('admin_settings.site_now_hidden'));
+    }
+
+    public function saveAccount(): void
+    {
+        $user = auth()->user();
+        $data = $this->validate([
+            'name' => 'required|string|max:255',
+            'email' => 'required|email|max:255|unique:users,email,'.$user->id,
+        ]);
+
+        // An operator email must never collide with a customer's — that would
+        // block the customer from ever obtaining a portal login (ensureUser).
+        if (Customer::query()->where('email', $data['email'])->exists()) {
+            $this->addError('email', __('admin_settings.is_customer'));
+
+            return;
+        }
+
+        $user->update($data);
+        $this->dispatch('notify', message: __('admin_settings.account_saved'));
+    }
+
+    public function inviteStaff(): void
+    {
+        $this->authorize('staff.manage');
+        $data = $this->validate([
+            'staffName' => 'required|string|max:255',
+            'staffEmail' => 'required|email|max:255|unique:users,email',
+            'staffRole' => 'required|in:Owner,Admin,Support,Billing,Read-only',
+        ]);
+
+        // Only an Owner may create another Owner.
+        if ($data['staffRole'] === 'Owner' && ! auth()->user()->hasRole('Owner')) {
+            $this->addError('staffRole', __('admin_settings.owner_only'));
+
+            return;
+        }
+        // Never turn a customer's portal login into an operator.
+        if (Customer::query()->where('email', $data['staffEmail'])->exists()) {
+            $this->addError('staffEmail', __('admin_settings.is_customer'));
+
+            return;
+        }
+
+        // Email/password-setup delivery is still mocked, so generate a temporary
+        // password and surface it once to the Owner to share securely — the
+        // account is usable immediately (a proper invite link follows with mail).
+        $temp = Str::password(14);
+        $user = User::create([
+            'name' => $data['staffName'],
+            'email' => $data['staffEmail'],
+            'password' => Hash::make($temp),
+            'is_admin' => true,
+        ]);
+        $user->assignRole($data['staffRole']);
+
+        $this->invitedEmail = $data['staffEmail'];
+        $this->invitedPassword = $temp;
+        $this->reset('staffName', 'staffEmail');
+        $this->staffRole = 'Support';
+        $this->dispatch('notify', message: __('admin_settings.staff_invited'));
+    }
+
+    public function setStaffRole(int $id, string $role): void
+    {
+        $this->authorize('staff.manage');
+        if (! in_array($role, User::OPERATOR_ROLES, true)) {
+            return;
+        }
+
+        $result = DB::transaction(function () use ($id, $role) {
+            // Serialize on the Owner role so the global owner count can't be
+            // raced to zero by concurrent demotions of different owners.
+            Role::query()->where('name', 'Owner')->lockForUpdate()->first();
+
+            $target = User::query()->whereKey($id)->lockForUpdate()->first();
+            if ($target === null) {
+                return 'gone';
+            }
+            if ($target->id === auth()->id()) {
+                return 'self';
+            }
+            // Only existing operators may be re-roled — never escalate a customer
+            // (or any non-staff) user into the console via a tampered id.
+            if (! $target->isOperator() || Customer::query()->where('email', $target->email)->exists()) {
+                return 'not_staff';
+            }
+            // Granting or revoking Owner is Owner-only.
+            if (($role === 'Owner' || $target->hasRole('Owner')) && ! auth()->user()->hasRole('Owner')) {
+                return 'owner_only';
+            }
+            // Never demote the last Owner.
+            if ($target->hasRole('Owner') && $role !== 'Owner' && $this->ownerCount() <= 1) {
+                return 'last_owner';
+            }
+            $target->syncRoles([$role]);
+
+            return 'ok';
+        });
+
+        $this->flash($result);
+    }
+
+    public function revokeStaff(int $id): void
+    {
+        $this->authorize('staff.manage');
+
+        $revokedPeers = [];
+
+        $result = DB::transaction(function () use ($id, &$revokedPeers) {
+            Role::query()->where('name', 'Owner')->lockForUpdate()->first();
+
+            $target = User::query()->whereKey($id)->lockForUpdate()->first();
+            if ($target === null || ! $target->isOperator()) {
+                return 'gone';
+            }
+            if ($target->id === auth()->id()) {
+                return 'self';
+            }
+            if ($target->hasRole('Owner') && $this->ownerCount() <= 1) {
+                return 'last_owner';
+            }
+            $target->syncRoles([]);
+            $target->update(['is_admin' => false]);
+
+            // Taking away the console but leaving the tunnel would be the worst
+            // of both: no access to the panel, still a route into the
+            // management network. Same revocation path as the VPN page uses.
+            foreach (VpnPeer::query()->where('user_id', $target->id)->get() as $peer) {
+                $peer->purgeSecret();
+                $peer->delete();
+                $revokedPeers[] = $peer->public_key;
+            }
+
+            return 'revoked';
+        });
+
+        // Dispatched only once the rows are committed: a worker picking the job
+        // up mid-transaction would still see the peer as active, leave it on the
+        // hub, and never be asked again — a revoked colleague would keep their
+        // tunnel until the next reconciliation happened to notice.
+        foreach ($revokedPeers as $publicKey) {
+            ApplyVpnPeer::dispatch($publicKey, null, false);
+        }
+
+        $this->flash($result);
+    }
+
+    private function flash(string $result): void
+    {
+        $msg = match ($result) {
+            'ok' => __('admin_settings.role_updated'),
+            'revoked' => __('admin_settings.staff_revoked'),
+            'self' => __('admin_settings.not_self'),
+            'owner_only' => __('admin_settings.owner_only'),
+            'last_owner' => __('admin_settings.last_owner'),
+            'not_staff' => __('admin_settings.not_staff'),
+            default => null,
+        };
+        if ($msg !== null) {
+            $this->dispatch('notify', message: $msg);
+        }
+    }
+
+    private function ownerCount(): int
+    {
+        return User::query()->whereHas('roles', fn ($q) => $q->where('name', 'Owner'))->count();
+    }
+
+    public function render()
+    {
+        $staff = User::query()
+            ->whereHas('roles', fn ($q) => $q->whereIn('name', User::OPERATOR_ROLES))
+            ->with('roles')
+            ->orderBy('name')
+            ->get()
+            ->map(fn (User $u) => [
+                'id' => $u->id,
+                'name' => $u->name,
+                'email' => $u->email,
+                'role' => $u->roles->first()?->name ?? '—',
+                'self' => $u->id === auth()->id(),
+            ]);
+
+        return view('livewire.admin.settings', [
+            'sitePublic' => AppSettings::bool('site.public', true),
+            'canManageSite' => auth()->user()?->can('site.manage') ?? false,
+            // Shown so nobody has to guess why they still see the real site.
+            'viewerOnVpn' => \Symfony\Component\HttpFoundation\IpUtils::checkIp(
+                (string) request()->ip(),
+                (array) config('admin_access.trusted_ranges', []),
+            ),
+            'staff' => $staff,
+            'roles' => User::OPERATOR_ROLES,
+            'canManageStaff' => auth()->user()->can('staff.manage'),
+            'isOwner' => auth()->user()->hasRole('Owner'),
+        ]);
+    }
+}

app/Livewire/Admin/Vpn.php

@@ -0,0 +1,357 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use App\Models\Host;
+use App\Models\VpnPeer;
+use App\Provisioning\Jobs\ApplyVpnPeer;
+use App\Provisioning\Jobs\SyncVpnPeers;
+use App\Models\User;
+use App\Services\Wireguard\ConfigHandoff;
+use App\Services\Wireguard\ConfigVault;
+use App\Services\Wireguard\Keypair;
+use App\Services\Wireguard\QrCode;
+use App\Services\Wireguard\WireguardHub;
+use Illuminate\Database\QueryException;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Str;
+use Illuminate\Validation\Rule;
+use Livewire\Attributes\Layout;
+use Livewire\Attributes\On;
+use Livewire\Component;
+
+/**
+ * VPN access management. The console container has no wg0, so live state is
+ * read from the database and refreshed by SyncVpnPeers on the provisioning
+ * queue — the poll below only nudges that job, it never talks to WireGuard.
+ */
+#[Layout('layouts.admin')]
+class Vpn extends Component
+{
+    public string $name = '';
+
+    /** Optional: a peer that generated its own key never hands us the private half. */
+    public string $publicKey = '';
+
+    /** Opaque handle for the freshly created config; see ConfigHandoff. */
+    public ?string $configToken = null;
+
+    public ?string $newConfigName = null;
+
+    /** Owner of the new access. Defaults to the operator creating it. */
+    public ?int $ownerId = null;
+
+    /** Keep the config so its owner can fetch it again behind their password. */
+    public bool $storeConfig = false;
+
+    public bool $showQr = false;
+
+    public function mount(): void
+    {
+        $this->authorize('viewAny', VpnPeer::class);
+        $this->ownerId = auth()->id();
+    }
+
+    /**
+     * mount() runs once; every later request — including the five-second poll —
+     * only hydrates. Without this, revoking vpn.manage would not take effect
+     * until the operator happened to reload the page, and the open tab would
+     * keep serving fresh peer state.
+     */
+    public function hydrate(): void
+    {
+        $this->authorize('viewAny', VpnPeer::class);
+    }
+
+    public function create(): void
+    {
+        $this->authorize('create', VpnPeer::class);
+
+        $this->validate([
+            'name' => 'required|string|max:255',
+            'publicKey' => 'nullable|string|max:64',
+            // An access belongs to a person, and only to an operator: a customer
+            // account must never own a way into the management network.
+            'ownerId' => ['required', Rule::exists('users', 'id')],
+        ]);
+
+        // Storing needs a key. Without one we would either write the credential
+        // in the clear or pretend we stored it — both worse than saying no.
+        if ($this->storeConfig && ! ConfigVault::available()) {
+            $this->addError('storeConfig', __('vpn.vault_unavailable'));
+
+            return;
+        }
+
+        $ownKey = trim($this->publicKey) !== '';
+
+        if ($this->storeConfig && $ownKey) {
+            $this->addError('storeConfig', __('vpn.cannot_store_foreign_key'));
+
+            return;
+        }
+
+        if ($ownKey && ! Keypair::isValidKey(trim($this->publicKey))) {
+            $this->addError('publicKey', __('vpn.invalid_key'));
+
+            return;
+        }
+
+        $keypair = $ownKey ? null : Keypair::generate();
+        $publicKey = $ownKey ? trim($this->publicKey) : $keypair->publicKey;
+
+        $hub = app(WireguardHub::class);
+
+        // Same lock the host pipeline holds while it reserves an address
+        // (ConfigureWireguard). Addresses come from one subnet but live in two
+        // tables, so neither unique index can catch the other's insert — the
+        // shared lock is what keeps a host and an access off the same tunnel IP.
+        try {
+            // Filled inside the transaction; only the handoff needs it afterwards.
+        $plainConfig = null;
+
+        $peer = Cache::lock('wireguard:allocate', 30)->block(10, function () use ($hub, $publicKey, $keypair, &$plainConfig) {
+            return DB::transaction(function () use ($hub, $publicKey, $keypair, &$plainConfig) {
+                // The owner row is locked for the whole insert, and revokeStaff()
+                // locks the same row: without that, a revocation could commit
+                // between the check and the insert, find no peer to remove, and
+                // leave the revoked colleague with a brand-new tunnel.
+                $owner = User::query()->whereKey($this->ownerId)->lockForUpdate()->first();
+                if ($owner === null || ! $owner->isOperator()) {
+                    return 'owner_must_be_operator';
+                }
+
+                // Inside the lock: checking before it would let two concurrent
+                // requests both pass and the loser hit the unique index as a
+                // 500. withTrashed, because a revoked peer keeps its key until
+                // the hub confirms removal.
+                $existing = VpnPeer::withTrashed()->where('public_key', $publicKey)->first();
+                if ($existing !== null) {
+                    return $existing->trashed() ? 'pending_removal' : 'duplicate_key';
+                }
+
+                // A host's key may not have been adopted into vpn_peers yet.
+                // Re-using it would make `wg set` rewrite that host's allowed-ip
+                // to the address allocated here — cutting the management tunnel
+                // to a live machine.
+                if (Host::query()->where('wg_pubkey', $publicKey)->exists()) {
+                    return 'host_key';
+                }
+
+                $ip = $hub->allocateIp();
+
+                // Built and encrypted here so the stored config is part of the
+                // same insert. Doing it afterwards could leave a live access
+                // whose config was never stored — unrecoverable, and the
+                // operator would create a second one not knowing why.
+                $secret = null;
+                if ($keypair !== null) {
+                    $plainConfig = $this->clientConfig($keypair, $ip);
+                    if ($this->storeConfig) {
+                        $secret = ConfigVault::encrypt($plainConfig);
+                    }
+                }
+
+                return VpnPeer::create([
+                    'name' => trim($this->name),
+                    'kind' => VpnPeer::KIND_STAFF,
+                    'user_id' => $this->ownerId,
+                    'public_key' => $publicKey,
+                    'allowed_ip' => $ip,
+                    'config_secret' => $secret,
+                    'enabled' => true,
+                    'present' => false,
+                    'created_by' => auth()->id(),
+                ]);
+                });
+            });
+        } catch (QueryException) {
+            // Backstop: the unique index caught a writer that did not take this
+            // lock. Report it like any other duplicate instead of a 500.
+            $this->addError('publicKey', __('vpn.duplicate_key'));
+
+            return;
+        }
+
+        if (is_string($peer)) {
+            $field = $peer === 'owner_must_be_operator' ? 'ownerId' : 'publicKey';
+            $this->addError($field, __('vpn.'.$peer));
+
+            return;
+        }
+
+        ApplyVpnPeer::dispatch($peer->public_key, $peer->allowed_ip, true);
+
+        // Whatever was on screen belongs to the previous access. Leaving it up
+        // after creating another one would present the wrong private config
+        // under the new name — and someone would hand it out.
+        $this->dismissConfig();
+
+        // Only a key we generated can be turned into a ready-to-use config.
+        if ($plainConfig !== null) {
+            $this->configToken = ConfigHandoff::put($plainConfig);
+            $this->newConfigName = $peer->name;
+        }
+
+        $this->reset('name', 'publicKey', 'storeConfig');
+        $this->ownerId = auth()->id();
+        $this->dispatch('notify', message: __('vpn.created'));
+    }
+
+    public function toggle(string $uuid): void
+    {
+        // Looked up globally and then judged by the policy: filtering it out of
+        // the query here would turn "not allowed" into a button that silently
+        // does nothing, which is exactly how the portal used to lie to people.
+        $peer = VpnPeer::query()->where('uuid', $uuid)->first();
+        if ($peer === null) {
+            return;
+        }
+        $this->authorize('block', $peer);
+
+        $peer->update(['enabled' => ! $peer->enabled]);
+        ApplyVpnPeer::dispatch($peer->public_key, $peer->allowed_ip, $peer->enabled);
+
+        $this->dispatch('notify', message: $peer->enabled ? __('vpn.unblocked') : __('vpn.blocked'));
+    }
+
+    #[On('vpn-peer-deleted')]
+    public function peerDeleted(): void
+    {
+        $this->dispatch('notify', message: __('vpn.deleted'));
+    }
+
+    /**
+     * Replace an access's keypair.
+     *
+     * The way back for an access whose config was never stored: nobody can hand
+     * out a private key that no longer exists, so the honest option is a new
+     * one. The old key stops working the moment the hub is updated, which is
+     * also what makes this the right tool for a lost or leaked device.
+     */
+    public function reissue(string $uuid): void
+    {
+        $peer = VpnPeer::query()->where('uuid', $uuid)->first();
+        if ($peer === null) {
+            return;
+        }
+        $this->authorize('update', $peer);
+
+        if ($peer->kind !== VpnPeer::KIND_STAFF) {
+            $this->dispatch('notify', message: __('vpn.reissue_staff_only'));
+
+            return;
+        }
+
+        $keypair = Keypair::generate();
+        $oldKey = $peer->public_key;
+        $config = $this->clientConfig($keypair, $peer->allowed_ip);
+
+        $peer->forceFill([
+            'public_key' => $keypair->publicKey,
+            'present' => false,
+            // Only re-stored when the vault can actually be used: without the key
+            // this would throw, and the console tells people to re-issue
+            // precisely when a stored config has become unreadable.
+            'config_secret' => $peer->hasStoredConfig() && ConfigVault::available()
+                ? ConfigVault::encrypt($config)
+                : null,
+        ])->save();
+
+        // Old key off the hub first, then the new one on: the other order would
+        // briefly leave two peers claiming the same tunnel address.
+        ApplyVpnPeer::dispatch($oldKey, null, false, force: true);
+        ApplyVpnPeer::dispatch($peer->public_key, $peer->allowed_ip, true);
+
+        $this->dismissConfig();
+        $this->configToken = ConfigHandoff::put($config);
+        $this->newConfigName = $peer->name;
+
+        $this->dispatch('notify', message: __('vpn.reissued'));
+    }
+
+    public function dismissConfig(): void
+    {
+        ConfigHandoff::forget($this->configToken);
+        $this->reset('configToken', 'newConfigName', 'showQr');
+    }
+
+    /**
+     * The list this operator is allowed to see: their own accesses, plus
+     * everything when they hold vpn.view.all. Filtering in the query as well as
+     * in the actions, so a forged uuid cannot reach a peer the page never showed.
+     */
+    private function visiblePeers()
+    {
+        $query = VpnPeer::query();
+
+        if (! auth()->user()?->can('vpn.view.all')) {
+            $query->where('kind', VpnPeer::KIND_STAFF)->where('user_id', auth()->id());
+        }
+
+        return $query;
+    }
+
+    public function toggleQr(): void
+    {
+        $this->showQr = ! $this->showQr;
+    }
+
+    /**
+     * wg-quick takes the interface name from the filename, and Linux caps
+     * interface names at 15 characters — so the label is slugged and cut rather
+     * than handing the operator a file that fails to come up.
+     */
+    public function configFilename(): string
+    {
+        $slug = Str::slug((string) $this->newConfigName) ?: 'clupilot';
+
+        return Str::limit($slug, 15, '').'.conf';
+    }
+
+    /** Polled by the view; throttled so a room full of open tabs cannot flood the queue. */
+    public function refreshPeers(): void
+    {
+        if (Cache::add('vpn:sync-dispatched', true, 8)) {
+            SyncVpnPeers::dispatch();
+        }
+    }
+
+    private function clientConfig(Keypair $keypair, string $ip): string
+    {
+        $hub = app(WireguardHub::class);
+
+        return implode("\n", [
+            '[Interface]',
+            'PrivateKey = '.$keypair->privateKey,
+            'Address = '.$ip.'/32',
+            '',
+            '[Peer]',
+            'PublicKey = '.$hub->publicKey(),
+            'Endpoint = '.$hub->endpoint(),
+            'AllowedIPs = '.config('provisioning.wireguard.subnet', '10.66.0.0/24'),
+            'PersistentKeepalive = 25',
+            '',
+        ]);
+    }
+
+    public function render()
+    {
+        $hub = app(WireguardHub::class);
+
+        return view('livewire.admin.vpn', [
+            'newConfig' => $config = ConfigHandoff::get($this->configToken),
+            'qrSvg' => $this->showQr && $config !== null ? QrCode::svg($config) : null,
+            'peers' => $this->visiblePeers()->with(['host', 'owner'])->orderByDesc('present')->orderBy('name')->get(),
+            'operators' => User::query()
+                ->whereHas('roles', fn ($q) => $q->whereIn('name', User::OPERATOR_ROLES))
+                ->orderBy('name')->get(['id', 'name', 'email']),
+            'canManage' => auth()->user()?->can('vpn.manage.all') ?? false,
+            'vaultAvailable' => ConfigVault::available(),
+            'hubEndpoint' => $hub->endpoint(),
+            'hubPublicKey' => $hub->publicKey(),
+            'lastSync' => VpnPeer::query()->max('observed_at'),
+        ]);
+    }
+}

app/Livewire/Admin/VpnConfigAccess.php

@@ -0,0 +1,133 @@
+<?php
+
+namespace App\Livewire\Admin;
+
+use App\Models\VpnPeer;
+use App\Services\Wireguard\ConfigHandoff;
+use App\Services\Wireguard\ConfigVault;
+use App\Services\Wireguard\QrCode;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Gate;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\RateLimiter;
+use Illuminate\Support\Str;
+use LivewireUI\Modal\ModalComponent;
+
+/**
+ * Retrieving a stored VPN config again, behind the owner's own password.
+ *
+ * The password is asked for on EVERY retrieval, not once per session: Laravel's
+ * password.confirm middleware keeps a 15-minute session stamp, which would
+ * authorise unlimited later downloads from an unattended browser — not what
+ * "enter your password to download it" means.
+ */
+class VpnConfigAccess extends ModalComponent
+{
+    public string $uuid;
+
+    public string $name = '';
+
+    public string $password = '';
+
+    /** Opaque handle; the plaintext never enters the component snapshot. */
+    public ?string $token = null;
+
+    public bool $showQr = false;
+
+    public function mount(string $uuid): void
+    {
+        $peer = VpnPeer::query()->where('uuid', $uuid)->firstOrFail();
+        $this->authorize('downloadConfig', $peer);
+
+        $this->uuid = $uuid;
+        $this->name = $peer->name;
+    }
+
+    /**
+     * Every later request re-checks: once revealed, the plaintext sits in the
+     * handoff cache for ten minutes, and an open modal would otherwise keep
+     * handing it out after the access was revoked or reassigned — exactly the
+     * window purgeSecret() exists to close.
+     */
+    public function hydrate(): void
+    {
+        $peer = VpnPeer::withTrashed()->where('uuid', $this->uuid)->first();
+
+        if ($peer === null || Gate::denies('downloadConfig', $peer)) {
+            ConfigHandoff::forget($this->token);
+            $this->token = null;
+            abort(403);
+        }
+    }
+
+    public function reveal(): void
+    {
+        // A retry must not still be showing the previous attempt's complaint.
+        $this->resetErrorBag('password');
+
+        $peer = VpnPeer::query()->where('uuid', $this->uuid)->firstOrFail();
+        $this->authorize('downloadConfig', $peer);
+
+        // Rate-limited per user, so a stolen session cannot grind the password.
+        $key = 'vpn-config:'.auth()->id();
+        if (RateLimiter::tooManyAttempts($key, 5)) {
+            $this->addError('password', __('vpn.too_many_attempts', ['seconds' => RateLimiter::availableIn($key)]));
+
+            return;
+        }
+
+        if (! Hash::check($this->password, auth()->user()->password)) {
+            RateLimiter::hit($key, 300);
+            Log::warning('VPN config download refused: wrong password', [
+                'user_id' => auth()->id(), 'peer' => $peer->uuid,
+            ]);
+            $this->addError('password', __('vpn.wrong_password'));
+
+            return;
+        }
+
+        RateLimiter::clear($key);
+
+        $plaintext = ConfigVault::decrypt((string) $peer->config_secret);
+        if ($plaintext === null) {
+            // Wrong or rotated key, or a tampered record. Never guess.
+            $this->addError('password', __('vpn.config_unreadable'));
+
+            return;
+        }
+
+        // Counted in the database, not read-modify-written here: two concurrent
+        // retrievals would otherwise record one. This is an audit trail, so
+        // under-reporting is the one failure mode it must not have.
+        VpnPeer::query()->whereKey($peer->getKey())->update([
+            'last_downloaded_at' => now(),
+            'download_count' => DB::raw('download_count + 1'),
+        ]);
+
+        Log::info('VPN config downloaded', ['user_id' => auth()->id(), 'peer' => $peer->uuid]);
+
+        $this->reset('password');
+        $this->token = ConfigHandoff::put($plaintext);
+    }
+
+    public function toggleQr(): void
+    {
+        $this->showQr = ! $this->showQr;
+    }
+
+    public function filename(): string
+    {
+        return Str::limit(Str::slug($this->name) ?: 'clupilot', 15, '').'.conf';
+    }
+
+    public function render()
+    {
+        $config = ConfigHandoff::get($this->token);
+
+        return view('livewire.admin.vpn-config-access', [
+            'config' => $config,
+            'qrSvg' => $config !== null && $this->showQr ? QrCode::svg($config) : null,
+        ]);
+    }
+}

app/Livewire/Auth/Login.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace App\Livewire\Auth;
+
+use Livewire\Attributes\Layout;
+use Livewire\Component;
+
+#[Layout('layouts.portal')]
+class Login extends Component
+{
+    public function render()
+    {
+        return view('livewire.auth.login');
+    }
+}

app/Livewire/Auth/Register.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace App\Livewire\Auth;
+
+use Livewire\Attributes\Layout;
+use Livewire\Component;
+
+/**
+ * Full-page signup view (R1/R2). The POST is handled by Fortify's registration
+ * feature (register.store → App\Actions\Fortify\CreateNewUser).
+ */
+#[Layout('layouts.portal')]
+class Register extends Component
+{
+    public function render()
+    {
+        return view('livewire.auth.register');
+    }
+}

app/Livewire/Auth/TwoFactorChallenge.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace App\Livewire\Auth;
+
+use Livewire\Attributes\Layout;
+use Livewire\Component;
+
+#[Layout('layouts.portal')]
+class TwoFactorChallenge extends Component
+{
+    public function render()
+    {
+        return view('livewire.auth.two-factor-challenge');
+    }
+}

app/Livewire/Backups.php

@@ -0,0 +1,58 @@
+<?php
+
+namespace App\Livewire;
+
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Number;
+use Livewire\Attributes\Layout;
+use Livewire\Component;
+
+#[Layout('layouts.portal-app')]
+class Backups extends Component
+{
+    public function render()
+    {
+        $locale = app()->getLocale();
+        $gb = fn (float $v) => Number::format($v, precision: 1, locale: $locale).' GB';
+        $date = fn (string $iso, string $fmt) => Carbon::parse($iso)->locale($locale)->isoFormat($fmt);
+
+        // 14 days of backup sizes for the bar chart.
+        $sizes = [18.1, 18.1, 18.2, 18.2, 18.2, 18.3, 18.3, 18.3, 18.3, 18.4, 18.4, 18.3, 18.4, 18.4];
+
+        $rows = [];
+        foreach (range(0, 6) as $i) {
+            $rows[] = [
+                'when' => $date(Carbon::parse('2026-07-24')->subDays($i)->toDateString(), 'dd, D. MMMM').', 03:1'.($i % 3 + 1),
+                'size' => $gb(18.4 - $i * 0.02),
+                'status' => 'ok',
+            ];
+        }
+
+        return view('livewire.backups', [
+            'rows' => $rows,
+            'lastTest' => $date('2026-07-01', 'LL'),
+            'sizeChart' => [
+                'type' => 'line',
+                'data' => [
+                    'labels' => array_map(fn ($i) => $date(Carbon::parse('2026-07-24')->subDays(13 - $i)->toDateString(), 'D.'), range(0, 13)),
+                    'datasets' => [[
+                        'label' => 'GB',
+                        'data' => $sizes,
+                        'borderColor' => 'token:accent',
+                        'fill' => true,
+                        'tension' => 0.35,
+                        'pointRadius' => 0,
+                        'borderWidth' => 2,
+                    ]],
+                ],
+                'options' => [
+                    'scales' => [
+                        'x' => ['grid' => ['display' => false]],
+                        'y' => ['beginAtZero' => false, 'grid' => ['color' => 'token:border']],
+                    ],
+                    'plugins' => ['legend' => ['display' => false]],
+                ],
+            ],
+        ]);
+    }
+}

app/Livewire/Billing.php

@@ -0,0 +1,183 @@
+<?php
+
+namespace App\Livewire;
+
+use App\Livewire\Concerns\ResolvesCustomer;
+use App\Models\Customer;
+use App\Models\Order;
+use App\Models\Subscription;
+use App\Services\Billing\AddonCatalogue;
+use App\Services\Billing\PlanCatalogue;
+use Illuminate\Support\Facades\DB;
+use Livewire\Attributes\Layout;
+use Livewire\Component;
+
+#[Layout('layouts.portal-app')]
+class Billing extends Component
+{
+    use ResolvesCustomer;
+
+    /**
+     * Record a purchase intent (order). Fulfillment (Stripe checkout + resize) is
+     * mocked for now — the order is created with status 'pending'.
+     */
+    public function purchase(string $type, ?string $key = null): void
+    {
+        $customer = $this->requireCustomer();
+        if ($customer === null) {
+            return;
+        }
+
+        $instance = $customer->instances()->latest('id')->first();
+        $currentPlan = $instance?->plan ?? 'start';
+        $plans = app(PlanCatalogue::class)->sellable();
+        $addons = (array) config('provisioning.addons');
+
+        [$plan, $amount, $addonKey] = match ($type) {
+            'upgrade' => [$key, (int) ($plans[$key]['price_cents'] ?? 0), null],
+            'storage' => [$currentPlan, (int) config('provisioning.storage_addon.price_cents', 0), null],
+            'traffic' => [$currentPlan, (int) config('provisioning.traffic.addon.price_cents', 0), null],
+            'addon' => [$currentPlan, (int) ($addons[$key]['price_cents'] ?? 0), $key],
+            default => [null, 0, null],
+        };
+
+        // Guard against invalid keys / non-upgrades.
+        $valid = match ($type) {
+            // By rank, matching PlanChange and the cards on the page. Comparing
+            // prices would call a grandfathered plan an upgrade to a smaller
+            // one and charge for the privilege.
+            'upgrade' => isset($plans[$key])
+                && (int) ($plans[$key]['tier'] ?? 0) > (int) ($instance?->subscription?->tier ?? $plans[$currentPlan]['tier'] ?? 0),
+            'storage' => true,
+            // Always available: running out of traffic is exactly when someone
+            // needs to be able to buy more, whatever plan they are on.
+            'traffic' => true,
+            'addon' => isset($addons[$key]),
+            default => false,
+        };
+        if (! $valid || $plan === null) {
+            return;
+        }
+
+        $datacenter = $instance?->host?->datacenter
+            ?? $customer->orders()->latest('id')->value('datacenter')
+            ?? 'fsn';
+
+        // A cart cannot hold two plan changes: they contradict each other and no
+        // checkout could resolve which one the customer meant. Choosing another
+        // replaces the pending one — add-ons still stack.
+        //
+        // Replacement and insert run together with the customer row locked:
+        // two clicks in flight could otherwise both delete and then both
+        // insert, leaving exactly the two upgrades this rule exists to prevent.
+        $replaced = DB::transaction(function () use ($customer, $type, $plan, $addonKey, $amount, $datacenter) {
+            Customer::query()->whereKey($customer->id)->lockForUpdate()->first();
+
+            $replaced = $type === 'upgrade'
+                ? Order::query()
+                    ->where('customer_id', $customer->id)
+                    ->where('status', 'pending')
+                    ->where('type', 'upgrade')
+                    ->delete()
+                : 0;
+
+            Order::create([
+                'customer_id' => $customer->id,
+                'plan' => $plan,
+                'type' => $type,
+                'addon_key' => $addonKey,
+                'amount_cents' => $amount,
+                'currency' => 'EUR',
+                'datacenter' => $datacenter,
+                'status' => 'pending',
+            ]);
+
+            return $replaced;
+        });
+
+        if ($replaced > 0) {
+            $this->dispatch('notify', message: __('billing.cart.plan_replaced'));
+        }
+
+        $this->dispatch('notify', message: __('billing.purchased'));
+    }
+
+    #[\Livewire\Attributes\On('order-removed')]
+    public function orderRemoved(): void
+    {
+        $this->dispatch('notify', message: __('billing.cart.removed'));
+    }
+
+    /**
+     * The terms to show as "your plan": the contract if there is one, and only
+     * otherwise the catalogue — someone browsing before they have bought.
+     *
+     * @param  array<string, mixed>  $catalogue
+     * @return array<string, mixed>
+     */
+    private function currentTerms(?Subscription $subscription, array $catalogue): array
+    {
+        if ($subscription === null) {
+            return $catalogue;
+        }
+
+        return [
+            'tier' => $subscription->tier,
+            // Per month: the card says "/ month", and a yearly contract stores
+            // the whole year.
+            'price_cents' => $subscription->monthlyPriceCents(),
+            'currency' => $subscription->currency,
+            'quota_gb' => $subscription->quota_gb,
+            'traffic_gb' => $subscription->traffic_gb,
+            'seats' => $subscription->seats,
+            'performance' => $subscription->performance,
+            'features' => $subscription->planVersion?->features ?? ($catalogue['features'] ?? []),
+        ];
+    }
+
+    public function render()
+    {
+        $customer = $this->customer();
+        $instance = $customer?->instances()->latest('id')->first();
+        $plans = app(PlanCatalogue::class)->sellable();
+        $currentKey = $instance?->plan ?? 'start';
+
+        // Rank, not price: a grandfathered plan can cost less than a smaller
+        // one does today, and offering that as an "upgrade" would charge a
+        // customer immediately for losing resources.
+        $currentTier = (int) ($instance?->subscription?->tier ?? $plans[$currentKey]['tier'] ?? 0);
+
+        $upgrades = collect($plans)
+            ->filter(fn ($p) => (int) ($p['tier'] ?? 0) > $currentTier)
+            ->keys()->all();
+
+        return view('livewire.billing', [
+            'currentKey' => $currentKey,
+            // What they HAVE comes from their contract; only what they could
+            // BUY comes from the shop. Reading this off the catalogue showed a
+            // customer today's price as though it were theirs, and dropped the
+            // card entirely once their plan stopped being sold.
+            'current' => $this->currentTerms($instance?->subscription, $plans[$currentKey] ?? []),
+            'instance' => $instance,
+            'plans' => $plans,
+            'features' => collect($plans)->map(fn ($p) => $p['features'] ?? [])->all(),
+            'upgrades' => $upgrades,
+            'storage' => (array) config('provisioning.storage_addon'),
+            'trafficAddon' => (array) config('provisioning.traffic.addon'),
+            // Resolved once: the cart and the plan cards must not state
+            // different tax treatments on the same page.
+            'tax' => \App\Services\Billing\TaxTreatment::for($customer),
+            'trafficMeter' => $instance !== null ? \App\Services\Traffic\TrafficMeter::for($instance) : null,
+            // Booked modules at the price they were booked at; everything else
+            // at today's. Reading them all off the catalogue would re-price
+            // half a customer's bill behind their back.
+            'addons' => collect(app(AddonCatalogue::class)->forSubscription($instance?->subscription))
+                ->except(AddonCatalogue::STORAGE)
+                ->all(),
+            'totalMonthlyCents' => $instance?->subscription?->totalMonthlyCents(),
+            'pending' => $customer
+                ? $customer->orders()->where('status', 'pending')->latest('id')->get()
+                : collect(),
+        ]);
+    }
+}

app/Livewire/Cloud.php

@@ -0,0 +1,91 @@
+<?php
+
+namespace App\Livewire;
+
+use App\Livewire\Concerns\ResolvesCustomer;
+use App\Models\MaintenanceWindow;
+use Illuminate\Support\Number;
+use Livewire\Attributes\Layout;
+use Livewire\Component;
+
+#[Layout('layouts.portal-app')]
+class Cloud extends Component
+{
+    use ResolvesCustomer;
+
+    public function render()
+    {
+        $locale = app()->getLocale();
+        $growth = [180, 188, 195, 199, 204, 210, 214, 219, 223, 228, 231, 235];
+
+        // The card is built from the customer's real service instance, so the
+        // maintenance badge below can be scoped to exactly that instance's host.
+        $customer = $this->customer();
+        $shown = $customer?->instances()
+            ->whereIn('status', ['active', 'provisioning', 'cancellation_scheduled'])
+            ->latest('id')->first();
+        $maintenance = MaintenanceWindow::forInstance($shown)->first();
+
+        // The instance carries what was actually provisioned, and the contract
+        // what was bought. Neither is the catalogue, which only describes what
+        // we would sell someone new — never what this customer already has.
+        $contract = $shown?->subscription;
+        $planKey = $shown?->plan ?? 'team';
+        $quota = (int) ($shown?->quota_gb ?? $contract?->quota_gb ?? 500);
+        // Usage metering is not wired yet — scale the illustrative curve into the
+        // instance's quota so the chart and the "x / y GB" label never disagree.
+        $curveMax = max($growth);
+        if ($curveMax > $quota) {
+            $growth = array_map(fn ($v) => (int) round($v / $curveMax * $quota), $growth);
+        }
+        $used = $growth[count($growth) - 1];
+        $domain = $shown?->custom_domain
+            ?: ($shown?->subdomain ? $shown->subdomain.'.'.config('provisioning.dns.zone', 'clupilot.com') : 'cloud.example.com');
+
+        return view('livewire.cloud', [
+            'instance' => [
+                'name' => $customer ? __('cloud.instance_name', ['name' => $customer->name]) : __('cloud.title'),
+                'domain' => $domain,
+                'status' => $shown->status ?? 'active',
+                'plan' => __('cloud.plan_line', [
+                    'plan' => 'CluPilot Cloud '.__('billing.plan.'.$planKey),
+                    // The line ends in "/mo", so a yearly contract has to be
+                    // divided down before it goes in.
+                    'price' => (int) round(($contract?->monthlyPriceCents() ?? 0) / 100),
+                ]),
+                'location' => __('cloud.datacenter'),
+                'version' => 'Nextcloud 31.0.4',
+                'php' => 'PHP 8.3 · MariaDB 11.4',
+                'storageUsed' => $used,
+                'storageQuota' => $quota,
+                'seats' => __('billing.seats_count', ['count' => $contract?->seats ?? 0]),
+                'performance' => __('billing.perf.'.($contract?->performance ?? 'standard')),
+            ],
+            'storageChart' => [
+                'type' => 'line',
+                'data' => [
+                    'labels' => ['', '', '', '', '', '', '', '', '', '', '', __('cloud.now')],
+                    'datasets' => [[
+                        'label' => 'GB',
+                        'data' => $growth,
+                        'borderColor' => 'token:accent',
+                        'backgroundColor' => 'token:accent/0.10',
+                        'fill' => true,
+                        'tension' => 0.35,
+                        'pointRadius' => 0,
+                        'borderWidth' => 2,
+                    ]],
+                ],
+                'options' => [
+                    'scales' => [
+                        'x' => ['grid' => ['display' => false]],
+                        'y' => ['beginAtZero' => false, 'grid' => ['color' => 'token:border']],
+                    ],
+                    'plugins' => ['legend' => ['display' => false]],
+                ],
+            ],
+            'storageLabel' => Number::format($used, locale: $locale).' / '.Number::format($quota, locale: $locale).' GB',
+            'maintenance' => $maintenance,
+        ]);
+    }
+}

app/Livewire/Concerns/BuildsRunSteps.php

@@ -0,0 +1,56 @@
+<?php
+
+namespace App\Livewire\Concerns;
+
+use App\Models\ProvisioningRun;
+
+/**
+ * Builds the {label, state} array a progress stepper renders from a run's
+ * pipeline + current step + status. Shared by admin and customer views.
+ */
+trait BuildsRunSteps
+{
+    /** @return array<int, array{label: string, state: string}> */
+    protected function buildRunSteps(?ProvisioningRun $run): array
+    {
+        if ($run === null) {
+            return [];
+        }
+
+        $pipeline = config('provisioning.pipelines.'.$run->pipeline, []);
+        $current = $run->current_step;
+        $status = $run->status;
+
+        $steps = [];
+        foreach ($pipeline as $index => $class) {
+            if ($status === ProvisioningRun::STATUS_COMPLETED || $index < $current) {
+                $state = 'done';
+            } elseif ($index === $current) {
+                $state = $status === ProvisioningRun::STATUS_FAILED ? 'failed' : 'running';
+            } else {
+                $state = 'pending';
+            }
+
+            $steps[] = ['label' => __(app($class)->label()), 'state' => $state];
+        }
+
+        return $steps;
+    }
+
+    protected function currentStepLabel(ProvisioningRun $run): string
+    {
+        $pipeline = config('provisioning.pipelines.'.$run->pipeline, []);
+        $class = $pipeline[$run->current_step] ?? null;
+
+        return $class ? __(app($class)->label()) : '—';
+    }
+
+    protected function runState(ProvisioningRun $run): string
+    {
+        return match ($run->status) {
+            ProvisioningRun::STATUS_COMPLETED => 'done',
+            ProvisioningRun::STATUS_FAILED => 'failed',
+            default => 'running',
+        };
+    }
+}

app/Livewire/Concerns/ResolvesCustomer.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Livewire\Concerns;
+
+use App\Models\Customer;
+
+/**
+ * Resolves the customer behind the signed-in portal user.
+ *
+ * Operator accounts (admins) have no Customer, so customer-scoped actions must
+ * NOT silently no-op — that reads as a dead button. requireCustomer() surfaces
+ * an explicit message instead and returns null so the caller can bail.
+ */
+trait ResolvesCustomer
+{
+    protected function customer(): ?Customer
+    {
+        $user = auth()->user();
+        if (! $user) {
+            return null;
+        }
+
+        // Prefer the explicit link; fall back to email for legacy unlinked accounts.
+        return Customer::query()->where('user_id', $user->id)->first()
+            ?? Customer::query()->where('email', $user->email)->first();
+    }
+
+    /** Same as customer(), but tells the user why nothing happened. */
+    protected function requireCustomer(): ?Customer
+    {
+        $customer = $this->customer();
+
+        if ($customer === null) {
+            $this->dispatch('notify', message: __('dashboard.no_customer_action'));
+        }
+
+        return $customer;
+    }
+}

app/Livewire/ConfirmCancelPackage.php

@@ -0,0 +1,78 @@
+<?php
+
+namespace App\Livewire;
+
+use App\Livewire\Concerns\ResolvesCustomer;
+use App\Models\Instance;
+use LivewireUI\Modal\ModalComponent;
+
+/**
+ * Cancel the customer's package (R5). Per the founder's decision: effective at
+ * the end of the billing term, irreversible once confirmed; at term end the
+ * customer receives a finished data export, then the instance is deprovisioned
+ * (both mocked for now). Requires typing the instance subdomain to confirm.
+ */
+class ConfirmCancelPackage extends ModalComponent
+{
+    use ResolvesCustomer;
+
+    public string $confirmName = '';
+
+    public function cancelPackage()
+    {
+        $customer = $this->customer();
+        // Target the ACTIVE package explicitly — a newer failed/deprovisioned
+        // record must not shadow an older active instance (v1: one active/customer).
+        $instance = $customer?->instances()->where('status', 'active')->latest('id')->first();
+
+        if ($instance === null) {
+            // Explain rather than silently closing: no customer behind this login
+            // (e.g. an operator account) or no active package to cancel.
+            $this->addError('confirmName', __($customer === null ? 'dashboard.no_customer_action' : 'settings.no_package'));
+
+            return null;
+        }
+
+        // Typed confirmation must match the instance subdomain.
+        if (trim($this->confirmName) !== (string) $instance->subdomain) {
+            $this->addError('confirmName', __('settings.cancel_mismatch'));
+
+            return;
+        }
+
+        $instance->update([
+            'status' => 'cancellation_scheduled',
+            'cancel_requested_at' => now(),
+            'service_ends_at' => $this->currentPeriodEnd($instance),
+        ]);
+
+        return $this->redirectRoute('settings', navigate: true);
+    }
+
+    /**
+     * End of the current monthly billing period, anchored on the subscription
+     * start (the order date) rather than assuming calendar-month billing.
+     */
+    private function currentPeriodEnd(Instance $instance): \Illuminate\Support\Carbon
+    {
+        $start = $instance->order?->created_at ?? $instance->created_at ?? now();
+
+        // Always add from the immutable start so the billing-day anchor is kept
+        // (chaining addMonth would drift a Jan-31 start to Feb-28 → Mar-28).
+        $months = 1;
+        while ($start->copy()->addMonthsNoOverflow($months)->lessThanOrEqualTo(now())) {
+            $months++;
+        }
+
+        return $start->copy()->addMonthsNoOverflow($months);
+    }
+
+    public function render()
+    {
+        $instance = $this->customer()?->instances()->where('status', 'active')->latest('id')->first();
+
+        return view('livewire.confirm-cancel-package', [
+            'subdomain' => $instance?->subdomain ?? '',
+        ]);
+    }
+}

app/Livewire/ConfirmCloseAccount.php

@@ -0,0 +1,65 @@
+<?php
+
+namespace App\Livewire;
+
+use App\Livewire\Concerns\ResolvesCustomer;
+use App\Models\Customer;
+use LivewireUI\Modal\ModalComponent;
+
+/**
+ * Close the whole CluPilot account (R5). Guarded: only allowed when no active
+ * package remains — an active subscription must be cancelled first. Sets
+ * closed_at; financial records are retained. Requires typing "LOESCHEN".
+ */
+class ConfirmCloseAccount extends ModalComponent
+{
+    use ResolvesCustomer;
+
+    public string $confirmWord = '';
+
+    public function closeAccount()
+    {
+        $customer = $this->customer();
+        // No customer behind this login (e.g. an operator account) — say so
+        // instead of leaving the button looking broken.
+        if ($customer === null) {
+            $this->addError('confirmWord', __('dashboard.no_customer_action'));
+
+            return null;
+        }
+
+        if ($this->hasActivePackage($customer)) {
+            $this->addError('confirmWord', __('settings.close_blocked'));
+
+            return;
+        }
+
+        if (mb_strtoupper(trim($this->confirmWord)) !== __('settings.close_keyword')) {
+            $this->addError('confirmWord', __('settings.close_mismatch'));
+
+            return;
+        }
+
+        $customer->update(['closed_at' => now(), 'status' => 'closed']);
+
+        return $this->redirectRoute('settings', navigate: true);
+    }
+
+    private function hasActivePackage(Customer $customer): bool
+    {
+        // Only genuinely-live packages block closure — a failed/cancelled/
+        // deprovisioned instance does not retain a service.
+        return $customer->instances()
+            ->whereIn('status', ['active', 'provisioning', 'cancellation_scheduled'])
+            ->exists();
+    }
+
+    public function render()
+    {
+        $customer = $this->customer();
+
+        return view('livewire.confirm-close-account', [
+            'blocked' => $customer !== null && $this->hasActivePackage($customer),
+        ]);
+    }
+}

app/Livewire/ConfirmRemoveOrder.php

@@ -0,0 +1,73 @@
+<?php
+
+namespace App\Livewire;
+
+use App\Livewire\Concerns\ResolvesCustomer;
+use App\Models\Order;
+use LivewireUI\Modal\ModalComponent;
+
+/**
+ * Taking a not-yet-paid purchase back out of the cart.
+ *
+ * Scoped to the signed-in customer's own orders: modals are reachable without
+ * the page's own guards, so the ownership check belongs here, not in the view
+ * that happens to link to it.
+ */
+class ConfirmRemoveOrder extends ModalComponent
+{
+    use ResolvesCustomer;
+
+    public string $uuid;
+
+    public string $label = '';
+
+    public int $amountCents = 0;
+
+    public function mount(string $uuid): void
+    {
+        $order = $this->order($uuid);
+        abort_if($order === null, 404);
+
+        $this->uuid = $uuid;
+        $this->label = $order->label();
+        $this->amountCents = $order->amount_cents;
+    }
+
+    public function remove(): void
+    {
+        $order = $this->order($this->uuid);
+
+        // Gone or already paid for: say so instead of pretending it worked.
+        if ($order === null) {
+            $this->dispatch('notify', message: __('billing.cart.gone'));
+            $this->closeModal();
+
+            return;
+        }
+
+        $order->delete();
+
+        $this->dispatch('order-removed');
+        $this->closeModal();
+    }
+
+    /** @return Order|null the customer's own, still-pending order */
+    private function order(string $uuid): ?Order
+    {
+        $customer = $this->customer();
+        if ($customer === null) {
+            return null;
+        }
+
+        return Order::query()
+            ->where('customer_id', $customer->id)
+            ->where('uuid', $uuid)
+            ->where('status', 'pending')
+            ->first();
+    }
+
+    public function render()
+    {
+        return view('livewire.confirm-remove-order');
+    }
+}

app/Livewire/CustomerProvisioning.php

@@ -0,0 +1,59 @@
+<?php
+
+namespace App\Livewire;
+
+use App\Livewire\Concerns\BuildsRunSteps;
+use App\Models\Customer;
+use App\Models\Order;
+use App\Models\ProvisioningRun;
+use Livewire\Component;
+
+/**
+ * Embedded live provisioning progress for the logged-in customer's order.
+ * Polls only itself so the dashboard's charts don't churn. Renders nothing once
+ * provisioning has completed.
+ */
+class CustomerProvisioning extends Component
+{
+    use BuildsRunSteps;
+
+    private function currentRun(): ?ProvisioningRun
+    {
+        $user = auth()->user();
+        if ($user === null) {
+            return null;
+        }
+
+        $customer = Customer::query()->where('email', $user->email)->first();
+        if ($customer === null) {
+            return null;
+        }
+
+        return ProvisioningRun::query()
+            ->where('subject_type', Order::class)
+            ->whereIn('subject_id', $customer->orders()->select('id'))
+            ->latest('id')
+            ->first();
+    }
+
+    public function render()
+    {
+        $run = $this->currentRun();
+
+        // Show the card while provisioning is in flight OR terminally failed; but
+        // only POLL while it can still change (terminal failed must not poll forever).
+        $show = $run !== null && $run->status !== ProvisioningRun::STATUS_COMPLETED;
+        $polling = $run !== null && in_array($run->status, [
+            ProvisioningRun::STATUS_PENDING,
+            ProvisioningRun::STATUS_RUNNING,
+            ProvisioningRun::STATUS_WAITING,
+        ], true);
+
+        return view('livewire.customer-provisioning', [
+            'active' => $show,
+            'polling' => $polling,
+            'failed' => $run?->status === ProvisioningRun::STATUS_FAILED,
+            'steps' => $show ? $this->buildRunSteps($run) : [],
+        ]);
+    }
+}

app/Livewire/Dashboard.php

@@ -0,0 +1,133 @@
+<?php
+
+namespace App\Livewire;
+
+use App\Livewire\Concerns\ResolvesCustomer;
+use App\Services\Traffic\TrafficMeter;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Number;
+use Livewire\Attributes\Layout;
+use Livewire\Component;
+
+#[Layout('layouts.portal-app')]
+class Dashboard extends Component
+{
+    use ResolvesCustomer;
+
+    public function render()
+    {
+        // Real numbers where they exist: traffic is metered, unlike the
+        // fixtures below, and a customer needs to see it before it runs out.
+        $instance = $this->customer()?->instances()->latest('id')->first();
+        $traffic = $instance !== null ? TrafficMeter::for($instance) : null;
+
+        // Locale-aware date / number formatting for the fixture values below.
+        $locale = app()->getLocale();
+        $date = fn (string $iso, string $fmt) => Carbon::parse($iso)->locale($locale)->isoFormat($fmt);
+        $gb = fn (float $v) => Number::format($v, precision: 1, locale: $locale).' GB';
+        // Fixture data until the provisioning engine (separate handoff) supplies
+        // real instances / metrics. Tenant-specific values stand in for DB rows.
+        $storageUsed = 235;
+        $storageQuota = 500;
+        $storagePercent = (int) round($storageUsed / max(1, $storageQuota) * 100);
+
+        // ~30 days of availability, gently trending near 100%.
+        $availability = [99.95, 99.97, 99.96, 99.98, 99.99, 99.97, 99.98, 99.99, 99.99, 99.98,
+            99.97, 99.99, 100, 99.98, 99.99, 99.99, 99.97, 99.98, 99.99, 100,
+            99.98, 99.99, 99.99, 99.98, 100, 99.99, 99.98, 99.99, 100, 99.98];
+
+        return view('livewire.dashboard', [
+            'traffic' => $traffic,
+            'storageUsed' => $storageUsed,
+            'storageQuota' => $storageQuota,
+            'storagePercent' => $storagePercent,
+            'usersActive' => 8,
+            'usersQuota' => 20,
+            'lastBackup' => '03:12',
+            'availability' => Number::format(99.98, precision: 2, locale: $locale),
+
+            'storageChart' => [
+                'type' => 'doughnut',
+                'data' => [
+                    'datasets' => [[
+                        'data' => [$storagePercent, 100 - $storagePercent],
+                        'backgroundColor' => ['token:accent', 'token:surface-2'],
+                        'borderWidth' => 0,
+                    ]],
+                ],
+                'options' => [
+                    'cutout' => '76%',
+                    'plugins' => [
+                        'legend' => ['display' => false],
+                        'tooltip' => ['enabled' => false],
+                    ],
+                ],
+            ],
+
+            'availabilityChart' => [
+                'type' => 'line',
+                'data' => [
+                    'labels' => array_fill(0, count($availability), ''),
+                    'datasets' => [[
+                        'data' => $availability,
+                        'borderColor' => 'token:success-bright',
+                        'backgroundColor' => 'token:success-bright/0.12',
+                        'fill' => true,
+                        'tension' => 0.4,
+                        'pointRadius' => 0,
+                        'borderWidth' => 2,
+                    ]],
+                ],
+                'options' => [
+                    'scales' => [
+                        'x' => ['display' => false],
+                        'y' => ['display' => false, 'min' => 99.9, 'max' => 100],
+                    ],
+                    'plugins' => [
+                        'legend' => ['display' => false],
+                        'tooltip' => ['enabled' => false],
+                    ],
+                ],
+            ],
+
+            'cloud' => [
+                'name' => 'Cloud der Kanzlei Berger',
+                'domain' => 'cloud.kanzlei-berger.at',
+                'package' => __('dashboard.cloud.plan_line', ['plan' => 'CluPilot Cloud Team', 'price' => 179]),
+                'since' => $date('2026-03-14', 'LL'),
+                'location' => __('dashboard.cloud.datacenter'),
+                'version' => 'Nextcloud 31.0.4',
+            ],
+
+            'onboarding' => [
+                ['label' => __('dashboard.onboarding.instance'), 'done' => true, 'date' => $date('2026-03-14', 'D. MMMM')],
+                ['label' => __('dashboard.onboarding.domain'), 'done' => true, 'date' => $date('2026-03-15', 'D. MMMM')],
+                ['label' => __('dashboard.onboarding.branding'), 'done' => true, 'date' => $date('2026-03-15', 'D. MMMM')],
+                ['label' => __('dashboard.onboarding.users'), 'done' => true, 'date' => $date('2026-03-16', 'D. MMMM')],
+                ['label' => __('dashboard.onboarding.migration'), 'done' => false, 'date' => null],
+                ['label' => __('dashboard.onboarding.training'), 'done' => false, 'date' => null],
+                ['label' => __('dashboard.onboarding.docs'), 'done' => false, 'date' => null],
+            ],
+
+            'backups' => [
+                ['when' => __('dashboard.today').', 03:12', 'size' => $gb(18.4)],
+                ['when' => __('dashboard.yesterday').', 03:09', 'size' => $gb(18.4)],
+                ['when' => $date('2026-07-21', 'D. MMMM').', 03:11', 'size' => $gb(18.3)],
+            ],
+
+            'modules' => [
+                ['icon' => 'cloud', 'name' => 'Nextcloud + Collabora', 'desc' => __('dashboard.modules.nextcloud'), 'status' => 'active'],
+                ['icon' => 'shield-check', 'name' => 'Vaultwarden', 'desc' => __('dashboard.modules.vaultwarden'), 'status' => 'active'],
+                ['icon' => 'receipt', 'name' => 'Paperless-ngx', 'desc' => __('dashboard.modules.paperless'), 'status' => 'available'],
+                ['icon' => 'pen', 'name' => __('dashboard.modules.signature_name'), 'desc' => __('dashboard.modules.signature'), 'status' => 'soon'],
+            ],
+
+            'activity' => [
+                ['icon' => 'download', 'text' => __('dashboard.activity_items.backup_ok'), 'time' => '03:12'],
+                ['icon' => 'shield-check', 'text' => __('dashboard.activity_items.security'), 'time' => '04:01'],
+                ['icon' => 'users', 'text' => __('dashboard.activity_items.upload'), 'time' => '07:56'],
+                ['icon' => 'shield-check', 'text' => __('dashboard.activity_items.cert'), 'time' => __('dashboard.yesterday').' 22:10'],
+            ],
+        ]);
+    }
+}

app/Livewire/Invoices.php

@@ -0,0 +1,58 @@
+<?php
+
+namespace App\Livewire;
+
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Number;
+use Livewire\Attributes\Layout;
+use Livewire\Component;
+
+#[Layout('layouts.portal-app')]
+class Invoices extends Component
+{
+    public function render()
+    {
+        $locale = app()->getLocale();
+        $eur = fn (float $v) => Number::currency($v, in: 'EUR', locale: $locale);
+        $date = fn (string $iso) => Carbon::parse($iso)->locale($locale)->isoFormat('LL');
+
+        $months = collect(['2026-03-01', '2026-04-01', '2026-05-01', '2026-06-01', '2026-07-01'])
+            ->map(fn ($m) => Carbon::parse($m)->locale($locale)->isoFormat('MMM'))->all();
+
+        $rows = [
+            ['no' => 'CP-2026-0007', 'date' => $date('2026-07-01'), 'amount' => $eur(198), 'status' => 'paid'],
+            ['no' => 'CP-2026-0006', 'date' => $date('2026-06-01'), 'amount' => $eur(198), 'status' => 'paid'],
+            ['no' => 'CP-2026-0005', 'date' => $date('2026-05-01'), 'amount' => $eur(198), 'status' => 'paid'],
+            ['no' => 'CP-2026-0004', 'date' => $date('2026-04-01'), 'amount' => $eur(179), 'status' => 'paid'],
+            ['no' => 'CP-2026-0003', 'date' => $date('2026-03-15'), 'amount' => $eur(179), 'status' => 'paid'],
+        ];
+
+        return view('livewire.invoices', [
+            'rows' => $rows,
+            'nextCharge' => $date('2026-08-01'),
+            'nextAmount' => $eur(198),
+            'spendChart' => [
+                'type' => 'line',
+                'data' => [
+                    'labels' => $months,
+                    'datasets' => [[
+                        'label' => 'EUR',
+                        'data' => [179, 179, 198, 198, 198],
+                        'borderColor' => 'token:accent',
+                        'fill' => true,
+                        'tension' => 0.35,
+                        'pointRadius' => 0,
+                        'borderWidth' => 2,
+                    ]],
+                ],
+                'options' => [
+                    'scales' => [
+                        'x' => ['grid' => ['display' => false]],
+                        'y' => ['beginAtZero' => true, 'grid' => ['color' => 'token:border']],
+                    ],
+                    'plugins' => ['legend' => ['display' => false]],
+                ],
+            ],
+        ]);
+    }
+}

app/Livewire/Settings.php

@@ -0,0 +1,162 @@
+<?php
+
+namespace App\Livewire;
+
+use App\Livewire\Concerns\ResolvesCustomer;
+use Illuminate\Support\Facades\Storage;
+use Livewire\Attributes\Layout;
+use Livewire\Attributes\Validate;
+use Livewire\Component;
+use Livewire\WithFileUploads;
+
+class Settings extends Component
+{
+    use ResolvesCustomer, WithFileUploads;
+
+    // Company / billing profile
+    #[Validate('required|string|max:255')]
+    public string $companyName = '';
+
+    #[Validate('nullable|string|max:255')]
+    public string $contactName = '';
+
+    #[Validate('nullable|string|max:64')]
+    public string $phone = '';
+
+    #[Validate('nullable|string|max:64')]
+    public string $vatId = '';
+
+    #[Validate('nullable|string|max:2000')]
+    public string $billingAddress = '';
+
+    // Branding
+    #[Validate('nullable|string|max:255')]
+    public string $brandDisplayName = '';
+
+    #[Validate('nullable|regex:/^#[0-9a-fA-F]{6}$/')]
+    public string $brandPrimary = '';
+
+    #[Validate('nullable|regex:/^#[0-9a-fA-F]{6}$/')]
+    public string $brandAccent = '';
+
+    /** New logo upload (validated on save). */
+    public $logo = null;
+
+    public ?string $brandLogoPath = null;
+
+    public function mount(): void
+    {
+        $c = $this->customer();
+        if ($c === null) {
+            return;
+        }
+        $this->companyName = $c->name ?? '';
+        $this->contactName = $c->contact_name ?? '';
+        $this->phone = $c->phone ?? '';
+        $this->vatId = $c->vat_id ?? '';
+        $this->billingAddress = $c->billing_address ?? '';
+        $this->brandDisplayName = $c->brand_display_name ?? '';
+        $this->brandPrimary = $c->brand_primary_color ?? '';
+        $this->brandAccent = $c->brand_accent_color ?? '';
+        $this->brandLogoPath = $c->brand_logo_path;
+    }
+
+    public function saveProfile(): void
+    {
+        $c = $this->requireCustomer();
+        if ($c === null) {
+            return;
+        }
+
+        $this->validateOnly('companyName');
+        $data = $this->validate([
+            'companyName' => 'required|string|max:255',
+            'contactName' => 'nullable|string|max:255',
+            'phone' => 'nullable|string|max:64',
+            'vatId' => 'nullable|string|max:64',
+            'billingAddress' => 'nullable|string|max:2000',
+        ]);
+
+        $c->update([
+            'name' => $data['companyName'],
+            'contact_name' => $data['contactName'] ?: null,
+            'phone' => $data['phone'] ?: null,
+            'vat_id' => $data['vatId'] ?: null,
+            'billing_address' => $data['billingAddress'] ?: null,
+        ]);
+
+        $this->dispatch('notify', message: __('settings.profile_saved'));
+    }
+
+    public function saveBranding(): void
+    {
+        $c = $this->requireCustomer();
+        if ($c === null) {
+            return;
+        }
+
+        $this->validate([
+            'brandDisplayName' => 'nullable|string|max:255',
+            'brandPrimary' => 'nullable|regex:/^#[0-9a-fA-F]{6}$/',
+            'brandAccent' => 'nullable|regex:/^#[0-9a-fA-F]{6}$/',
+            'logo' => 'nullable|image|mimes:png,webp|max:2048',
+        ]);
+
+        // Store the new upload, but keep the old file until the DB row that
+        // references it is updated — delete the old one only after that commits,
+        // so a failed update never orphans a file or dangles a reference.
+        $oldToDelete = null;
+        if ($this->logo !== null) {
+            $oldToDelete = $this->brandLogoPath;
+            $this->brandLogoPath = $this->logo->store('branding', 'public');
+            $this->logo = null;
+        }
+
+        $c->update([
+            'brand_display_name' => $this->brandDisplayName ?: null,
+            'brand_primary_color' => $this->brandPrimary ?: null,
+            'brand_accent_color' => $this->brandAccent ?: null,
+            'brand_logo_path' => $this->brandLogoPath,
+        ]);
+
+        if ($oldToDelete !== null && $oldToDelete !== $this->brandLogoPath) {
+            Storage::disk('public')->delete($oldToDelete);
+        }
+
+        $this->dispatch('notify', message: __('settings.branding_saved'));
+    }
+
+    public function removeLogo(): void
+    {
+        $c = $this->requireCustomer();
+        if ($c === null) {
+            return;
+        }
+        if ($this->brandLogoPath !== null) {
+            Storage::disk('public')->delete($this->brandLogoPath);
+        }
+        $this->brandLogoPath = null;
+        $c->update(['brand_logo_path' => null]);
+        $this->dispatch('notify', message: __('settings.branding_saved'));
+    }
+
+    #[Layout('layouts.portal-app')]
+    public function render()
+    {
+        $c = $this->customer();
+        // Prefer the active/cancelling instance for the package section so the
+        // controls line up with what cancellation actually targets.
+        $active = $c?->instances()->where('status', 'active')->latest('id')->first();
+        $scheduled = $c?->instances()->where('status', 'cancellation_scheduled')->latest('id')->first();
+        $instance = $active ?? $scheduled ?? $c?->instances()->latest('id')->first();
+
+        return view('livewire.settings', [
+            'customer' => $c,
+            'instance' => $instance,
+            'branding' => $c?->brandingResolved(),
+            'logoUrl' => $this->brandLogoPath ? Storage::disk('public')->url($this->brandLogoPath) : null,
+            'hasActivePackage' => $active !== null,
+            'cancellationScheduled' => $active === null && $scheduled !== null,
+        ]);
+    }
+}

app/Livewire/Support.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Livewire;
+
+use Illuminate\Support\Carbon;
+use Livewire\Attributes\Layout;
+use Livewire\Component;
+
+#[Layout('layouts.portal-app')]
+class Support extends Component
+{
+    public function render()
+    {
+        $locale = app()->getLocale();
+        $date = fn (string $iso) => Carbon::parse($iso)->locale($locale)->isoFormat('LL');
+
+        return view('livewire.support', [
+            'tickets' => [
+                ['subject' => __('support.ticket_migration'), 'ref' => '#4821', 'date' => $date('2026-07-22'), 'status' => 'open'],
+                ['subject' => __('support.ticket_training'), 'ref' => '#4790', 'date' => $date('2026-07-18'), 'status' => 'progress'],
+                ['subject' => __('support.ticket_smtp'), 'ref' => '#4712', 'date' => $date('2026-07-04'), 'status' => 'closed'],
+            ],
+            'faqs' => [
+                ['q' => __('support.faq_q1'), 'a' => __('support.faq_a1')],
+                ['q' => __('support.faq_q2'), 'a' => __('support.faq_a2')],
+                ['q' => __('support.faq_q3'), 'a' => __('support.faq_a3')],
+            ],
+        ]);
+    }
+}

app/Livewire/Users.php

@@ -0,0 +1,203 @@
+<?php
+
+namespace App\Livewire;
+
+use App\Livewire\Concerns\ResolvesCustomer;
+use App\Models\Customer;
+use App\Models\Seat;
+use Illuminate\Database\UniqueConstraintViolationException;
+use Illuminate\Support\Facades\DB;
+use Livewire\Attributes\Layout;
+use Livewire\Attributes\Validate;
+use Livewire\Component;
+
+#[Layout('layouts.portal-app')]
+class Users extends Component
+{
+    use ResolvesCustomer;
+
+    #[Validate('required|email|max:255')]
+    public string $inviteEmail = '';
+
+    #[Validate('nullable|string|max:255')]
+    public string $inviteName = '';
+
+    #[Validate('required|in:admin,member,readonly')]
+    public string $inviteRole = 'member';
+
+    public function mount(): void
+    {
+        // Every customer starts with themselves as the owner seat. firstOrCreate
+        // keyed on (customer_id, email) is idempotent; the catch covers the
+        // concurrent-first-visit race against the unique index.
+        $customer = $this->customer();
+        if ($customer !== null && $customer->seats()->count() === 0) {
+            try {
+                $customer->seats()->firstOrCreate(
+                    ['email' => $customer->email],
+                    ['name' => $customer->name, 'role' => 'owner', 'status' => 'active', 'invited_at' => now()],
+                );
+            } catch (UniqueConstraintViolationException) {
+                // Another concurrent first visit created it — fine.
+            }
+        }
+    }
+
+    public function invite(): void
+    {
+        $customer = $this->requireCustomer();
+        if ($customer === null) {
+            return;
+        }
+
+        $data = $this->validate();
+
+        // Serialize the limit check with the insert so two concurrent invites for
+        // the last free seat can't both pass (lock the customer row).
+        $result = DB::transaction(function () use ($customer, $data) {
+            $locked = Customer::query()->whereKey($customer->id)->lockForUpdate()->first();
+
+            if ($locked->seats()->where('email', $data['inviteEmail'])->exists()) {
+                return 'duplicate';
+            }
+            if ($this->usedSeats($locked) >= $this->seatLimit($locked)) {
+                return 'limit';
+            }
+
+            $locked->seats()->create([
+                'email' => $data['inviteEmail'],
+                'name' => $data['inviteName'] ?: null,
+                'role' => $data['inviteRole'],
+                'status' => 'invited',
+                'invited_at' => now(),
+            ]);
+
+            return 'ok';
+        });
+
+        if ($result === 'limit') {
+            $this->addError('inviteEmail', __('users.limit_reached'));
+
+            return;
+        }
+        if ($result === 'duplicate') {
+            $this->addError('inviteEmail', __('users.duplicate'));
+
+            return;
+        }
+
+        $this->reset('inviteEmail', 'inviteName', 'inviteRole');
+        $this->inviteRole = 'member';
+        $this->dispatch('notify', message: __('users.invited'));
+    }
+
+    public function setRole(string $uuid, string $role): void
+    {
+        if (! in_array($role, Seat::ROLES, true)) {
+            return;
+        }
+        $customer = $this->requireCustomer();
+        if ($customer === null) {
+            return;
+        }
+
+        // Lock the customer so a concurrent owner change can't race past the guard.
+        $ok = DB::transaction(function () use ($customer, $uuid, $role) {
+            Customer::query()->whereKey($customer->id)->lockForUpdate()->first();
+            $seat = $customer->seats()->where('uuid', $uuid)->first();
+            if ($seat === null) {
+                return true;
+            }
+            if ($seat->role === 'owner' && $role !== 'owner' && $customer->seats()->where('role', 'owner')->count() <= 1) {
+                return false; // would remove the last owner
+            }
+            $seat->update(['role' => $role]);
+
+            return true;
+        });
+
+        if (! $ok) {
+            $this->dispatch('notify', message: __('users.last_owner'));
+        }
+    }
+
+    public function revoke(string $uuid): void
+    {
+        $customer = $this->requireCustomer();
+        if ($customer === null) {
+            return;
+        }
+
+        $result = DB::transaction(function () use ($customer, $uuid) {
+            Customer::query()->whereKey($customer->id)->lockForUpdate()->first();
+            $seat = $customer->seats()->where('uuid', $uuid)->first();
+            if ($seat === null) {
+                return 'gone';
+            }
+            if ($seat->role === 'owner' && $customer->seats()->where('role', 'owner')->count() <= 1) {
+                return 'last_owner';
+            }
+            $seat->delete();
+
+            return 'ok';
+        });
+
+        if ($result === 'last_owner') {
+            $this->dispatch('notify', message: __('users.last_owner'));
+        } elseif ($result === 'ok') {
+            $this->dispatch('notify', message: __('users.revoked'));
+        }
+    }
+
+    public function resend(string $uuid): void
+    {
+        // Invite delivery is mocked for now.
+        if ($this->seat($uuid) !== null) {
+            $this->dispatch('notify', message: __('users.resent'));
+        }
+    }
+
+    private function ownerCount(): int
+    {
+        $customer = $this->customer();
+
+        return $customer ? $customer->seats()->where('role', 'owner')->count() : 0;
+    }
+
+    private function usedSeats(Customer $customer): int
+    {
+        return $customer->seats()->where('status', '!=', 'revoked')->count();
+    }
+
+    private function seatLimit(Customer $customer): int
+    {
+        // The entitlement follows the active (or cancelling) package, not a newer
+        // failed/deprovisioned record.
+        $instance = $customer->instances()->whereIn('status', ['active', 'cancellation_scheduled'])->latest('id')->first()
+            ?? $customer->instances()->latest('id')->first();
+        // From the contract: how many people a customer may invite is part of
+        // what they bought. Cutting a plan's seats in the catalogue must not
+        // lock users out of an existing customer's cloud.
+        return (int) ($instance?->subscription?->seats ?? 5);
+    }
+
+    private function seat(string $uuid): ?Seat
+    {
+        $customer = $this->customer();
+
+        return $customer?->seats()->where('uuid', $uuid)->first();
+    }
+
+    public function render()
+    {
+        $customer = $this->customer();
+        $seats = $customer ? $customer->seats()->orderByRaw("role = 'owner' desc")->orderBy('email')->get() : collect();
+
+        return view('livewire.users', [
+            'seats' => $seats,
+            'used' => $customer ? $this->usedSeats($customer) : 0,
+            'limit' => $customer ? $this->seatLimit($customer) : 0,
+            'roles' => Seat::ROLES,
+        ]);
+    }
+}

app/Mail/MaintenanceAnnouncementMail.php

@@ -0,0 +1,47 @@
+<?php
+
+namespace App\Mail;
+
+use App\Models\Customer;
+use App\Models\MaintenanceWindow;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Mail\Mailable;
+use Illuminate\Mail\Mailables\Content;
+use Illuminate\Mail\Mailables\Envelope;
+use Illuminate\Mail\Mailables\Headers;
+use Illuminate\Queue\SerializesModels;
+
+class MaintenanceAnnouncementMail extends Mailable implements ShouldQueue
+{
+    use Queueable, SerializesModels;
+
+    /** The ledger row this mail confirms once actually delivered. */
+    public ?int $notificationId = null;
+
+    public function __construct(
+        public MaintenanceWindow $window,
+        public Customer $customer,
+    ) {}
+
+    public function headers(): Headers
+    {
+        return new Headers(text: $this->notificationId ? ['X-CP-Notification' => (string) $this->notificationId] : []);
+    }
+
+    public function envelope(): Envelope
+    {
+        return new Envelope(subject: __('maintenance.mail_subject', ['title' => $this->window->title]));
+    }
+
+    public function content(): Content
+    {
+        return new Content(markdown: 'mail.maintenance-announcement', with: [
+            'title' => $this->window->title,
+            'description' => $this->window->public_description,
+            'startsAt' => $this->window->starts_at,
+            'endsAt' => $this->window->ends_at,
+            'name' => $this->customer->name,
+        ]);
+    }
+}

app/Mail/MaintenanceCancelledMail.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace App\Mail;
+
+use App\Models\Customer;
+use App\Models\MaintenanceWindow;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Mail\Mailable;
+use Illuminate\Mail\Mailables\Content;
+use Illuminate\Mail\Mailables\Envelope;
+use Illuminate\Mail\Mailables\Headers;
+use Illuminate\Queue\SerializesModels;
+
+class MaintenanceCancelledMail extends Mailable implements ShouldQueue
+{
+    use Queueable, SerializesModels;
+
+    /** The ledger row this mail confirms once actually delivered. */
+    public ?int $notificationId = null;
+
+    public function __construct(
+        public MaintenanceWindow $window,
+        public Customer $customer,
+    ) {}
+
+    public function headers(): Headers
+    {
+        return new Headers(text: $this->notificationId ? ['X-CP-Notification' => (string) $this->notificationId] : []);
+    }
+
+    public function envelope(): Envelope
+    {
+        return new Envelope(subject: __('maintenance.mail_cancel_subject', ['title' => $this->window->title]));
+    }
+
+    public function content(): Content
+    {
+        return new Content(markdown: 'mail.maintenance-cancelled', with: [
+            'title' => $this->window->title,
+            'name' => $this->customer->name,
+        ]);
+    }
+}

app/Models/Backup.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class Backup extends Model
+{
+    protected $fillable = ['instance_id', 'external_job_id', 'schedule', 'last_ok_at', 'status'];
+
+    protected function casts(): array
+    {
+        return ['last_ok_at' => 'datetime'];
+    }
+
+    public function instance(): BelongsTo
+    {
+        return $this->belongsTo(Instance::class);
+    }
+}

app/Models/Builders/AppendOnlyBuilder.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace App\Models\Builders;
+
+use Illuminate\Database\Eloquent\Builder;
+use RuntimeException;
+
+/**
+ * A query builder that refuses to rewrite history.
+ *
+ * Model events (`updating`, `deleting`) only fire for instance operations, so a
+ * guard on the model alone still lets `Model::query()->where(...)->update(...)`
+ * through — which is exactly the shape a careless data fix takes. For a table
+ * whose value IS that it cannot be edited, the guard has to sit where the bulk
+ * operations pass.
+ *
+ * Not a security boundary: anyone with database access can still do as they
+ * please. It is a guard against the application quietly doing it by accident,
+ * which is the realistic way a register loses its meaning.
+ */
+class AppendOnlyBuilder extends Builder
+{
+    public function update(array $values)
+    {
+        throw new RuntimeException(
+            'The proof register is append-only. Record a correcting event instead of editing history.'
+        );
+    }
+
+    public function delete()
+    {
+        throw new RuntimeException(
+            'The proof register is append-only. A record that can be deleted is not evidence.'
+        );
+    }
+
+    public function forceDelete()
+    {
+        return $this->delete();
+    }
+}

app/Models/Concerns/HasUuid.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Models\Concerns;
+
+use Illuminate\Support\Str;
+
+/**
+ * Assigns a random UUID on creation. Records that expose a `uuid` column use it
+ * as their route key (R11: URLs address records by UUID, not integer PK).
+ */
+trait HasUuid
+{
+    protected static function bootHasUuid(): void
+    {
+        static::creating(function ($model) {
+            if (empty($model->uuid)) {
+                $model->uuid = (string) Str::uuid();
+            }
+        });
+    }
+
+    public function getRouteKeyName(): string
+    {
+        return 'uuid';
+    }
+}

app/Models/Customer.php

@@ -0,0 +1,144 @@
+<?php
+
+namespace App\Models;
+
+use App\Models\Concerns\HasUuid;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Database\UniqueConstraintViolationException;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Str;
+use RuntimeException;
+
+class Customer extends Model
+{
+    /** Comparable form: spaces and punctuation are cosmetic in a VAT number. */
+    public static function normaliseVatId(?string $value): string
+    {
+        return strtoupper(preg_replace('/[\s.-]+/', '', (string) $value) ?? '');
+    }
+
+    public function normalisedVatId(): string
+    {
+        return self::normaliseVatId($this->vat_id);
+    }
+
+    /**
+     * True only for the value that was actually checked. Binding it to the
+     * value rather than to a flag means editing the field cannot inherit the
+     * old confirmation, whichever code path does the editing.
+     */
+    public function hasVerifiedVatId(): bool
+    {
+        // Both sides normalised: a verifier that stores the number in display
+        // form ("DE 811 907 980") must not invalidate a genuine confirmation.
+        return $this->vat_id_verified_at !== null
+            && $this->normalisedVatId() !== ''
+            && $this->normalisedVatId() === self::normaliseVatId($this->vat_id_verified_value);
+    }
+
+    /** @use HasFactory<\Database\Factories\CustomerFactory> */
+    use HasFactory, HasUuid;
+
+    protected $fillable = [
+        'user_id', 'name', 'contact_name', 'email', 'phone', 'vat_id', 'vat_id_verified_at', 'vat_id_verified_value', 'billing_address',
+        'locale', 'stripe_customer_id', 'status', 'closed_at',
+        'brand_display_name', 'brand_logo_path', 'brand_primary_color', 'brand_accent_color',
+    ];
+
+    protected function casts(): array
+    {
+        return ['closed_at' => 'datetime', 'vat_id_verified_at' => 'datetime'];
+    }
+
+    public function seats(): HasMany
+    {
+        return $this->hasMany(Seat::class);
+    }
+
+    /**
+     * Resolve branding: customer values where set, else CluPilot defaults. Used
+     * for previews and snapshotted into the provisioning run so retries are
+     * deterministic. NULL is stored for "unset" — defaults are never copied in.
+     *
+     * @return array{display_name:string,logo_path:?string,primary_color:string,accent_color:string,is_default:bool}
+     */
+    public function brandingResolved(): array
+    {
+        $defaults = (array) config('provisioning.branding_defaults');
+
+        return [
+            'display_name' => $this->brand_display_name ?: ($defaults['display_name'] ?? 'CluPilot'),
+            'logo_path' => $this->brand_logo_path ?: ($defaults['logo_path'] ?? null),
+            'primary_color' => $this->brand_primary_color ?: ($defaults['primary_color'] ?? '#f97316'),
+            'accent_color' => $this->brand_accent_color ?: ($defaults['accent_color'] ?? '#c2560a'),
+            'is_default' => $this->brand_display_name === null
+                && $this->brand_logo_path === null
+                && $this->brand_primary_color === null
+                && $this->brand_accent_color === null,
+        ];
+    }
+
+    public function user(): BelongsTo
+    {
+        return $this->belongsTo(User::class);
+    }
+
+    public function orders(): HasMany
+    {
+        return $this->hasMany(Order::class);
+    }
+
+    public function instances(): HasMany
+    {
+        return $this->hasMany(Instance::class);
+    }
+
+    /**
+     * Find or create the portal login account for this customer and link it.
+     * Race-safe against the unique email index, and never links an operator
+     * account — that would carry admin authorization into an impersonated
+     * "customer" session.
+     */
+    public function ensureUser(): User
+    {
+        if ($this->user) {
+            return $this->user;
+        }
+
+        if (($existing = User::query()->where('email', $this->email)->first()) !== null) {
+            $this->assertNotAdmin($existing);
+            $this->update(['user_id' => $existing->id]);
+
+            return $existing;
+        }
+
+        try {
+            $user = User::query()->create([
+                'email' => $this->email,
+                'name' => $this->name,
+                'password' => Hash::make(Str::random(40)),
+                'is_admin' => false,
+            ]);
+        } catch (UniqueConstraintViolationException) {
+            // Concurrent first-time creation — re-fetch and link the winner.
+            $user = User::query()->where('email', $this->email)->firstOrFail();
+            $this->assertNotAdmin($user);
+        }
+
+        $this->update(['user_id' => $user->id]);
+
+        return $user->refresh();
+    }
+
+    private function assertNotAdmin(User $user): void
+    {
+        if ($user->is_admin || $user->isOperator()) {
+            throw new RuntimeException(
+                "Refusing to link operator account {$user->email} as a portal login for customer {$this->id}.",
+            );
+        }
+    }
+}

app/Models/Datacenter.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Models;
+
+use App\Models\Concerns\HasUuid;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+
+class Datacenter extends Model
+{
+    /** @use HasFactory<\Database\Factories\DatacenterFactory> */
+    use HasFactory, HasUuid;
+
+    protected $fillable = ['code', 'name', 'location', 'active'];
+
+    protected function casts(): array
+    {
+        return ['active' => 'boolean'];
+    }
+
+    public function scopeActive(Builder $query): Builder
+    {
+        return $query->where('active', true);
+    }
+
+    public function hosts()
+    {
+        return $this->hasMany(Host::class, 'datacenter', 'code');
+    }
+}

app/Models/DnsRecord.php

@@ -0,0 +1,16 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class DnsRecord extends Model
+{
+    protected $fillable = ['instance_id', 'provider', 'record_id', 'fqdn', 'type', 'value'];
+
+    public function instance(): BelongsTo
+    {
+        return $this->belongsTo(Instance::class);
+    }
+}

app/Models/Host.php

@@ -0,0 +1,129 @@
+<?php
+
+namespace App\Models;
+
+use App\Models\Concerns\HasUuid;
+use App\Provisioning\Contracts\ProvisioningSubject;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsToMany;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Database\Eloquent\Relations\MorphMany;
+
+class Host extends Model implements ProvisioningSubject
+{
+    /** @use HasFactory<\Database\Factories\HostFactory> */
+    use HasFactory, HasUuid;
+
+    protected $fillable = [
+        'name', 'datacenter', 'cluster', 'public_ip', 'wg_ip', 'wg_pubkey',
+        'ssh_host_key', 'api_token_ref', 'total_gb', 'total_ram_mb', 'cpu_cores',
+        'cpu_weight', 'reserve_pct', 'pve_version', 'node', 'status', 'last_seen_at', 'dns_name', 'dns_record_id',
+    ];
+
+    protected $hidden = ['api_token_ref'];
+
+    protected function casts(): array
+    {
+        return [
+            'api_token_ref' => 'encrypted',
+            'last_seen_at' => 'datetime',
+            'total_gb' => 'integer',
+            'total_ram_mb' => 'integer',
+            'cpu_cores' => 'integer',
+            'cpu_weight' => 'integer',
+            'reserve_pct' => 'integer',
+        ];
+    }
+
+    /** Placement runs (polymorphic subject). */
+    public function runs(): MorphMany
+    {
+        return $this->morphMany(ProvisioningRun::class, 'subject');
+    }
+
+    /** Runner hook: a failed onboarding run moves the host to the error status. */
+    public function onProvisioningFailed(): void
+    {
+        $this->update(['status' => 'error']);
+    }
+
+    public function instances(): HasMany
+    {
+        return $this->hasMany(Instance::class);
+    }
+
+    public function maintenanceWindows(): BelongsToMany
+    {
+        return $this->belongsToMany(MaintenanceWindow::class);
+    }
+
+    /** Free committable storage: total minus reserve. */
+    public function freeGb(): int
+    {
+        if ($this->total_gb === null) {
+            return 0;
+        }
+
+        return (int) floor($this->total_gb * (100 - $this->reserve_pct) / 100);
+    }
+
+    /**
+     * Host storage already committed, counted as the VM disk allocation
+     * (disk_gb) since that is what is actually placed on the host — not the
+     * (smaller) Nextcloud user quota. A failed instance still counts while its VM
+     * exists (has a vmid); a failure before any VM was created releases it.
+     */
+    public function committedGb(): int
+    {
+        return (int) $this->instances()
+            ->where(fn ($q) => $q->where('status', '!=', 'failed')->orWhereNotNull('vmid'))
+            ->sum('disk_gb');
+    }
+
+    /** Storage still available for new instances. */
+    public function availableGb(): int
+    {
+        return max(0, $this->freeGb() - $this->committedGb());
+    }
+
+    /** Used-storage percentage (committed vs committable free), 0–100. */
+    public function usedPct(): int
+    {
+        $free = $this->freeGb();
+
+        return $free > 0 ? min(100, (int) round($this->committedGb() / $free * 100)) : 0;
+    }
+
+    /**
+     * Heartbeat health from last_seen_at: online (≤5 min), stale (≤30 min),
+     * offline (older or never seen). Drives the health dot in the console.
+     */
+    public function healthState(): string
+    {
+        if ($this->last_seen_at === null) {
+            return 'offline';
+        }
+        $minutes = $this->last_seen_at->diffInMinutes(now());
+
+        return match (true) {
+            $minutes <= 5 => 'online',
+            $minutes <= 30 => 'stale',
+            default => 'offline',
+        };
+    }
+
+    /**
+     * Placement (spec §1): first active host in the datacenter with enough free
+     * committable storage. Cluster is ignored in v1.0.
+     */
+    public static function placeableIn(string $datacenter, int $quotaGb): ?self
+    {
+        return self::query()
+            ->where('datacenter', $datacenter)
+            ->where('status', 'active')
+            ->orderBy('name')
+            ->get()
+            ->first(fn (self $host) => $host->availableGb() >= $quotaGb);
+    }
+}

app/Models/Instance.php

@@ -0,0 +1,85 @@
+<?php
+
+namespace App\Models;
+
+use App\Models\Concerns\HasUuid;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Database\Eloquent\Relations\HasOne;
+
+class Instance extends Model
+{
+    /** @use HasFactory<\Database\Factories\InstanceFactory> */
+    use HasFactory, HasUuid;
+
+    protected $fillable = [
+        'customer_id', 'order_id', 'host_id', 'vmid', 'guest_ip', 'plan', 'quota_gb', 'traffic_addons', 'disk_gb',
+        'ram_mb', 'cores', 'subdomain', 'custom_domain', 'nc_admin_ref',
+        'route_written', 'cert_ok', 'status', 'cancel_requested_at', 'service_ends_at',
+    ];
+
+    protected $hidden = ['nc_admin_ref'];
+
+    protected function casts(): array
+    {
+        return [
+            'nc_admin_ref' => 'encrypted',
+            'route_written' => 'boolean',
+            'cert_ok' => 'boolean',
+            'vmid' => 'integer',
+            'traffic_addons' => 'integer',
+            'quota_gb' => 'integer',
+            'disk_gb' => 'integer',
+            'ram_mb' => 'integer',
+            'cores' => 'integer',
+            'cancel_requested_at' => 'datetime',
+            'service_ends_at' => 'datetime',
+        ];
+    }
+
+    public function customer(): BelongsTo
+    {
+        return $this->belongsTo(Customer::class);
+    }
+
+    public function order(): BelongsTo
+    {
+        return $this->belongsTo(Order::class);
+    }
+
+    /**
+     * The contract this machine fulfils. The authority on what the customer is
+     * entitled to — the catalogue only describes what we sell today.
+     */
+    public function subscription(): HasOne
+    {
+        return $this->hasOne(Subscription::class);
+    }
+
+    public function host(): BelongsTo
+    {
+        return $this->belongsTo(Host::class);
+    }
+
+    public function dnsRecords(): HasMany
+    {
+        return $this->hasMany(DnsRecord::class);
+    }
+
+    public function backups(): HasMany
+    {
+        return $this->hasMany(Backup::class);
+    }
+
+    public function monitoringTargets(): HasMany
+    {
+        return $this->hasMany(MonitoringTarget::class);
+    }
+
+    public function onboardingTasks(): HasMany
+    {
+        return $this->hasMany(OnboardingTask::class);
+    }
+}

app/Models/InstanceTraffic.php

@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class InstanceTraffic extends Model
+{
+    protected $table = 'instance_traffic';
+
+    protected $guarded = [];
+
+    protected function casts(): array
+    {
+        return [
+            'rx_bytes' => 'integer',
+            'tx_bytes' => 'integer',
+            'last_netin' => 'integer',
+            'last_netout' => 'integer',
+            'notified_percent' => 'integer',
+            'throttled' => 'boolean',
+            'sampled_at' => 'datetime',
+            'throttled_at' => 'datetime',
+        ];
+    }
+
+    public function instance(): BelongsTo
+    {
+        return $this->belongsTo(Instance::class);
+    }
+
+    public static function currentPeriod(): string
+    {
+        return now()->format('Y-m');
+    }
+}

app/Models/MaintenanceNotification.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class MaintenanceNotification extends Model
+{
+    protected $fillable = ['maintenance_window_id', 'customer_id', 'event', 'email', 'sent_at', 'claimed_at'];
+
+    protected function casts(): array
+    {
+        return ['sent_at' => 'datetime', 'claimed_at' => 'datetime'];
+    }
+
+    public function window(): BelongsTo
+    {
+        return $this->belongsTo(MaintenanceWindow::class, 'maintenance_window_id');
+    }
+
+    public function customer(): BelongsTo
+    {
+        return $this->belongsTo(Customer::class);
+    }
+}

app/Models/MaintenanceWindow.php

@@ -0,0 +1,130 @@
+<?php
+
+namespace App\Models;
+
+use App\Models\Concerns\HasUuid;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsToMany;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Support\Collection;
+
+class MaintenanceWindow extends Model
+{
+    /** @use HasFactory<\Database\Factories\MaintenanceWindowFactory> */
+    use HasFactory, HasUuid;
+
+    /** How far before the start the banner appears (Codex: 72 h). */
+    public const DISPLAY_HOURS = 72;
+
+    protected $fillable = [
+        'title', 'public_description', 'internal_notes', 'starts_at', 'ends_at',
+        'state', 'created_by', 'published_at', 'cancelled_at', 'cancellation_reason',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'starts_at' => 'datetime',
+            'ends_at' => 'datetime',
+            'published_at' => 'datetime',
+            'cancelled_at' => 'datetime',
+        ];
+    }
+
+    public function hosts(): BelongsToMany
+    {
+        return $this->belongsToMany(Host::class);
+    }
+
+    public function deliveries(): HasMany
+    {
+        return $this->hasMany(MaintenanceNotification::class);
+    }
+
+    /** Derived lifecycle state — never stored (Codex). */
+    public function derivedState(): string
+    {
+        if ($this->state === 'cancelled') {
+            return 'cancelled';
+        }
+        if ($this->state === 'draft') {
+            return 'draft';
+        }
+        if (now()->lt($this->starts_at)) {
+            return 'upcoming';
+        }
+        if (now()->lte($this->ends_at)) {
+            return 'active';
+        }
+
+        return 'completed';
+    }
+
+    public function isPublished(): bool
+    {
+        return $this->state === 'scheduled';
+    }
+
+    /** Service-bearing customers on the assigned hosts (recomputed live). */
+    public function affectedCustomers(): Collection
+    {
+        $hostIds = $this->hosts()->pluck('hosts.id');
+        if ($hostIds->isEmpty()) {
+            return collect();
+        }
+
+        return Customer::query()
+            ->whereHas('instances', fn (Builder $q) => $q
+                ->whereIn('host_id', $hostIds)
+                ->whereIn('status', ['active', 'provisioning', 'cancellation_scheduled']))
+            ->get();
+    }
+
+    /**
+     * Scheduled windows within the display horizon that affect ONE instance's
+     * host — for a per-instance badge, so a customer with several instances
+     * never sees another instance's maintenance on this card.
+     */
+    public static function forInstance(?Instance $instance): Collection
+    {
+        if ($instance === null || $instance->host_id === null) {
+            return collect();
+        }
+
+        return self::query()
+            ->where('state', 'scheduled')
+            ->where('ends_at', '>=', now())
+            ->where('starts_at', '<=', now()->addHours(self::DISPLAY_HOURS))
+            ->whereHas('hosts', fn (Builder $q) => $q->whereKey($instance->host_id))
+            ->orderBy('starts_at')
+            ->get();
+    }
+
+    /**
+     * Scheduled windows to show a given customer right now: within the display
+     * horizon (72 h before start until the end) and touching one of the
+     * customer's service instances' hosts.
+     */
+    public static function bannerFor(Customer $customer): Collection
+    {
+        $hostIds = Instance::query()
+            ->where('customer_id', $customer->id)
+            ->whereIn('status', ['active', 'provisioning', 'cancellation_scheduled'])
+            ->whereNotNull('host_id')
+            ->pluck('host_id')->unique();
+
+        if ($hostIds->isEmpty()) {
+            return collect();
+        }
+
+        return self::query()
+            ->where('state', 'scheduled')
+            ->where('ends_at', '>=', now())
+            ->where('starts_at', '<=', now()->addHours(self::DISPLAY_HOURS))
+            ->whereHas('hosts', fn (Builder $q) => $q->whereIn('hosts.id', $hostIds))
+            ->orderBy('starts_at')
+            ->get();
+    }
+}

app/Models/MonitoringTarget.php

@@ -0,0 +1,16 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class MonitoringTarget extends Model
+{
+    protected $fillable = ['instance_id', 'external_id', 'url', 'status'];
+
+    public function instance(): BelongsTo
+    {
+        return $this->belongsTo(Instance::class);
+    }
+}

app/Models/OnboardingTask.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class OnboardingTask extends Model
+{
+    protected $fillable = ['instance_id', 'key', 'done', 'done_at'];
+
+    protected function casts(): array
+    {
+        return ['done' => 'boolean', 'done_at' => 'datetime'];
+    }
+
+    public function instance(): BelongsTo
+    {
+        return $this->belongsTo(Instance::class);
+    }
+}

app/Models/Order.php

@@ -0,0 +1,109 @@
+<?php
+
+namespace App\Models;
+
+use App\Models\Concerns\HasUuid;
+use App\Services\Billing\TaxTreatment;
+use App\Provisioning\Contracts\ProvisioningSubject;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\HasOne;
+use Illuminate\Database\Eloquent\Relations\MorphMany;
+
+class Order extends Model implements ProvisioningSubject
+{
+    /** @use HasFactory<\Database\Factories\OrderFactory> */
+    use HasFactory, HasUuid;
+
+    protected $fillable = [
+        'customer_id', 'plan', 'plan_version_id', 'type', 'addon_key', 'amount_cents', 'currency',
+        'datacenter', 'stripe_event_id', 'stripe_subscription_id', 'status',
+    ];
+
+    protected function casts(): array
+    {
+        return ['amount_cents' => 'integer', 'plan_version_id' => 'integer'];
+    }
+
+    /**
+     * What this order actually buys, in words.
+     *
+     * Lives on the model rather than in the view: the cart, the invoice list and
+     * any future confirmation mail must not each invent their own wording for
+     * the same row.
+     */
+    public function label(): string
+    {
+        return match ($this->type) {
+            'upgrade' => __('billing.cart.upgrade', ['plan' => ucfirst($this->plan)]),
+            'storage' => __('billing.cart.storage', ['gb' => (int) config('provisioning.storage_addon.gb', 100)]),
+            'traffic' => __('billing.cart.traffic', ['gb' => (int) config('provisioning.traffic.addon.gb', 1000)]),
+            'addon' => __('billing.addon.'.$this->addon_key.'.name'),
+            default => __('billing.cart.plan', ['plan' => ucfirst($this->plan)]),
+        };
+    }
+
+    /**
+     * Monthly or one-off.
+     *
+     * Traffic is bought for the month that is running out and does not renew;
+     * everything else changes the recurring bill.
+     */
+    public function isRecurring(): bool
+    {
+        return $this->type !== 'traffic';
+    }
+
+    /**
+     * Net is what is stored; gross is what gets charged — and how much VAT that
+     * is depends on the customer, not on a global setting.
+     */
+    public function grossCents(): int
+    {
+        return $this->taxTreatment()->grossCents($this->amount_cents);
+    }
+
+    public function taxTreatment(): TaxTreatment
+    {
+        return TaxTreatment::for($this->customer);
+    }
+
+    /** Only a pending order is still the customer's to change. */
+    public function isRemovable(): bool
+    {
+        return $this->status === 'pending';
+    }
+
+    public function customer(): BelongsTo
+    {
+        return $this->belongsTo(Customer::class);
+    }
+
+    public function instance(): HasOne
+    {
+        return $this->hasOne(Instance::class);
+    }
+
+    /** The contract this order opened, if it was the purchase that opened one. */
+    public function subscription(): HasOne
+    {
+        return $this->hasOne(Subscription::class);
+    }
+
+    public function runs(): MorphMany
+    {
+        return $this->morphMany(ProvisioningRun::class, 'subject');
+    }
+
+    /**
+     * Runner hook: a failed provisioning run marks the order failed (no
+     * auto-refund) AND releases the reserved instance, so its quota stops
+     * counting against host capacity.
+     */
+    public function onProvisioningFailed(): void
+    {
+        $this->update(['status' => 'failed']);
+        $this->instance()->update(['status' => 'failed']);
+    }
+}

app/Models/PlanFamily.php

@@ -0,0 +1,94 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Concerns\HasUuids;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Support\Carbon;
+use RuntimeException;
+
+/**
+ * A plan line — the thing that has a name.
+ *
+ * "Team" stays Team through every price change and every resize. Orders,
+ * instances and contracts have referred to plans by `key` since day one, so the
+ * key is the one part of a family that must never move.
+ */
+class PlanFamily extends Model
+{
+    use HasFactory;
+    use HasUuids;
+
+    protected $guarded = [];
+
+    protected static function booted(): void
+    {
+        static::updating(function (self $family) {
+            // Orders, instances and every subscription snapshot store this
+            // string. Renaming it does not rename those — it orphans them, and
+            // a checkout in flight for this family stops matching its own
+            // version. Display names are what the `name` column is for.
+            if ($family->isDirty('key')) {
+                throw new RuntimeException(
+                    'A plan family key is permanent; existing orders and contracts refer to it by name. '.
+                    'Change the display name instead.'
+                );
+            }
+        });
+
+        static::deleting(function (self $family) {
+            if ($family->versions()->whereNotNull('published_at')->exists()) {
+                throw new RuntimeException(
+                    'A plan family with published versions cannot be deleted; customers are contracted to them. '.
+                    'Switch sales off instead — it disappears from the shop and stays on record.'
+                );
+            }
+
+            // Only drafts left. The foreign key restricts, so they have to go
+            // explicitly — and nothing was ever promised on a draft.
+            $family->versions->each->delete();
+        });
+    }
+
+    protected function casts(): array
+    {
+        return [
+            'tier' => 'integer',
+            'sales_enabled' => 'boolean',
+        ];
+    }
+
+    public function uniqueIds(): array
+    {
+        return ['uuid'];
+    }
+
+    public function versions(): HasMany
+    {
+        return $this->hasMany(PlanVersion::class);
+    }
+
+    /**
+     * The version on sale at a given moment, or null.
+     *
+     * Resolved with sole(): two overlapping windows are a mistake we want to
+     * hear about, not one we want silently resolved by whichever row the
+     * database happened to return first.
+     *
+     * @throws \Illuminate\Database\MultipleRecordsFoundException on overlap
+     */
+    public function versionAt(?Carbon $at = null): ?PlanVersion
+    {
+        $query = $this->versions()->available($at);
+
+        return $query->count() === 0 ? null : $query->sole();
+    }
+
+    /** On sale right now: not killed by the switch, and a version is running. */
+    public function isSellableAt(?Carbon $at = null): bool
+    {
+        return $this->sales_enabled && $this->versionAt($at) !== null;
+    }
+}

app/Models/PlanPrice.php

@@ -0,0 +1,85 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Concerns\HasUuids;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use RuntimeException;
+
+/**
+ * What a version costs for one term.
+ *
+ * One row per version AND term, each with its own Stripe Price id — a Stripe
+ * Price carries its own recurring interval, so monthly and yearly can never
+ * share one. Amounts are NET; what is actually charged depends on the
+ * customer's tax treatment.
+ *
+ * Frozen with its version. Repricing means publishing a new version, which is
+ * what Stripe requires anyway — a Stripe Price is immutable, so a rise mints a
+ * new one and existing subscriptions keep the old.
+ *
+ * The reason is not tidiness. A checkout is not instant: the session opens, the
+ * customer types their card details, the webhook arrives. An amount edited in
+ * that gap would contract them at a price they were never quoted, while their
+ * payment carries the old one. Only `stripe_price_id` stays writable, because
+ * it is filled in after the fact.
+ */
+class PlanPrice extends Model
+{
+    use HasFactory;
+    use HasUuids;
+
+    /** What publishing the version nails down. */
+    public const FROZEN = ['plan_version_id', 'term', 'amount_cents', 'currency'];
+
+    protected $guarded = [];
+
+    protected static function booted(): void
+    {
+        static::updating(function (self $price) {
+            // A draft is still a draft: nothing has been quoted to anyone.
+            if ($price->version?->isPublished() !== true) {
+                return;
+            }
+
+            $frozen = array_intersect(array_keys($price->getDirty()), self::FROZEN);
+
+            if ($frozen !== []) {
+                throw new RuntimeException(
+                    'The price of a published plan version is fixed; tried to change: '.implode(', ', $frozen).
+                    '. Publish a new version instead — someone may be at the checkout looking at this one.'
+                );
+            }
+        });
+
+        static::deleting(function (self $price) {
+            // Same loophole as editing. Remove the price of a version someone is
+            // checking out on, and their payment lands on a plan that can no
+            // longer be priced — the order is recorded, no contract opens, and
+            // they are left paid-for and unprovisioned.
+            if ($price->version?->isPublished() === true) {
+                throw new RuntimeException(
+                    'The price of a published plan version cannot be deleted. '.
+                    'Close the version\'s availability window instead.'
+                );
+            }
+        });
+    }
+
+    protected function casts(): array
+    {
+        return ['amount_cents' => 'integer'];
+    }
+
+    public function uniqueIds(): array
+    {
+        return ['uuid'];
+    }
+
+    public function version(): BelongsTo
+    {
+        return $this->belongsTo(PlanVersion::class, 'plan_version_id');
+    }
+}

app/Models/PlanVersion.php

@@ -0,0 +1,167 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Concerns\HasUuids;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Support\Carbon;
+use RuntimeException;
+
+/**
+ * What a plan WAS at a point in time.
+ *
+ * A customer buys a version, not a name. Once a version is published it is
+ * fixed: publication is a promise made in public, and it is made whether or not
+ * anyone has bought yet — which is why the lock is on publication and not on
+ * the first sale. Selling different terms means publishing a new version, and
+ * the old one keeps describing what its customers are owed.
+ *
+ * The availability WINDOW is not frozen. Rescheduling when a version is sold
+ * changes nothing about what it promises, and the owner has to be able to move
+ * a launch date without rewriting the plan.
+ */
+class PlanVersion extends Model
+{
+    use HasFactory;
+    use HasUuids;
+
+    /** Everything publication nails down. */
+    public const FROZEN = [
+        'plan_family_id', 'version', 'quota_gb', 'traffic_gb', 'seats', 'ram_mb',
+        'cores', 'disk_gb', 'performance', 'template_vmid', 'features', 'published_at',
+    ];
+
+    protected $guarded = [];
+
+    protected static function booted(): void
+    {
+        static::updating(function (self $version) {
+            // A draft is still a draft: nothing has been promised to anyone.
+            if ($version->getOriginal('published_at') === null) {
+                return;
+            }
+
+            $frozen = array_intersect(array_keys($version->getDirty()), self::FROZEN);
+
+            if ($frozen !== []) {
+                throw new RuntimeException(
+                    'A published plan version is immutable; tried to change: '.implode(', ', $frozen).
+                    '. Publish a new version instead — the customers on this one bought these terms.'
+                );
+            }
+        });
+
+        static::deleting(function (self $version) {
+            // Deleting is the loophole that would undo the rest. Contracts and
+            // orders point here to record what was sold, and the foreign keys
+            // null out on delete — so removing a published version quietly
+            // erases the provenance of every customer on it, and can leave an
+            // in-flight checkout resolving against whatever replaced it.
+            if ($version->isPublished()) {
+                throw new RuntimeException(
+                    'A published plan version cannot be deleted; customers are contracted to it. '.
+                    'Close its availability window instead — it stops being sold and stays on record.'
+                );
+            }
+        });
+    }
+
+    protected function casts(): array
+    {
+        return [
+            'version' => 'integer',
+            'quota_gb' => 'integer',
+            'traffic_gb' => 'integer',
+            'seats' => 'integer',
+            'ram_mb' => 'integer',
+            'cores' => 'integer',
+            'disk_gb' => 'integer',
+            'template_vmid' => 'integer',
+            'features' => 'array',
+            'available_from' => 'datetime',
+            'available_until' => 'datetime',
+            'published_at' => 'datetime',
+        ];
+    }
+
+    public function uniqueIds(): array
+    {
+        return ['uuid'];
+    }
+
+    public function family(): BelongsTo
+    {
+        return $this->belongsTo(PlanFamily::class, 'plan_family_id');
+    }
+
+    public function prices(): HasMany
+    {
+        return $this->hasMany(PlanPrice::class);
+    }
+
+    /**
+     * Published, and inside its window at `$at`.
+     *
+     * Half-open [from, until): `until` is the first moment the version is no
+     * longer sold, so a successor starting exactly then leaves neither a gap
+     * nor an overlap.
+     */
+    public function scopeAvailable(Builder $query, ?Carbon $at = null): Builder
+    {
+        $at ??= now();
+
+        return $query
+            ->whereNotNull('published_at')
+            ->where('available_from', '<=', $at)
+            ->where(fn (Builder $open) => $open
+                ->whereNull('available_until')
+                ->orWhere('available_until', '>', $at));
+    }
+
+    public function isAvailableAt(?Carbon $at = null): bool
+    {
+        $at ??= now();
+
+        return $this->published_at !== null
+            && $this->available_from->lessThanOrEqualTo($at)
+            && ($this->available_until === null || $this->available_until->greaterThan($at));
+    }
+
+    public function isPublished(): bool
+    {
+        return $this->published_at !== null;
+    }
+
+    public function priceFor(string $term, ?string $currency = null): ?PlanPrice
+    {
+        return $this->prices()
+            ->where('term', $term)
+            ->where('currency', $currency ?? Subscription::catalogueCurrency())
+            ->first();
+    }
+
+    /**
+     * The capabilities, in the shape the rest of the app already speaks.
+     *
+     * @return array<string, mixed>
+     */
+    public function capabilities(): array
+    {
+        return [
+            'tier' => (int) $this->family->tier,
+            'quota_gb' => $this->quota_gb,
+            'traffic_gb' => $this->traffic_gb,
+            'seats' => $this->seats,
+            'ram_mb' => $this->ram_mb,
+            'cores' => $this->cores,
+            'disk_gb' => $this->disk_gb,
+            'performance' => $this->performance,
+            'template_vmid' => $this->template_vmid,
+            'features' => $this->features ?? [],
+        ];
+    }
+}

app/Models/ProvisioningRun.php

@@ -0,0 +1,78 @@
+<?php
+
+namespace App\Models;
+
+use App\Models\Concerns\HasUuid;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Database\Eloquent\Relations\MorphTo;
+
+class ProvisioningRun extends Model
+{
+    /** @use HasFactory<\Database\Factories\ProvisioningRunFactory> */
+    use HasFactory, HasUuid;
+
+    public const STATUS_PENDING = 'pending';
+    public const STATUS_RUNNING = 'running';
+    public const STATUS_WAITING = 'waiting';
+    public const STATUS_PAUSED = 'paused';
+    public const STATUS_COMPLETED = 'completed';
+    public const STATUS_FAILED = 'failed';
+
+    protected $fillable = [
+        'subject_type', 'subject_id', 'pipeline', 'current_step', 'status',
+        'attempt', 'max_attempts', 'next_attempt_at', 'started_at', 'finished_at',
+        'error', 'context',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'context' => 'array',
+            'next_attempt_at' => 'datetime',
+            'started_at' => 'datetime',
+            'finished_at' => 'datetime',
+            'current_step' => 'integer',
+            'attempt' => 'integer',
+            'max_attempts' => 'integer',
+        ];
+    }
+
+    public function subject(): MorphTo
+    {
+        return $this->morphTo();
+    }
+
+    public function events(): HasMany
+    {
+        return $this->hasMany(ProvisioningStepEvent::class, 'run_id');
+    }
+
+    public function resources(): HasMany
+    {
+        return $this->hasMany(RunResource::class, 'run_id');
+    }
+
+    /** Read a single key from the json context. */
+    public function context(string $key, mixed $default = null): mixed
+    {
+        return data_get($this->context, $key, $default);
+    }
+
+    /** Merge values into the json context and persist. */
+    public function mergeContext(array $values): void
+    {
+        $this->context = array_merge($this->context ?? [], $values);
+        $this->save();
+    }
+
+    /** Remove a key from the json context and persist (e.g. scrubbing a secret). */
+    public function forgetContext(string $key): void
+    {
+        $context = $this->context ?? [];
+        unset($context[$key]);
+        $this->context = $context;
+        $this->save();
+    }
+}

app/Models/ProvisioningStepEvent.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+/**
+ * Append-only run event. Eloquent manages created_at only (no updated_at).
+ */
+class ProvisioningStepEvent extends Model
+{
+    public const UPDATED_AT = null;
+
+    protected $fillable = ['run_id', 'step', 'attempt', 'outcome', 'message', 'external_ref'];
+
+    public function run(): BelongsTo
+    {
+        return $this->belongsTo(ProvisioningRun::class, 'run_id');
+    }
+}

app/Models/RunResource.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+/**
+ * Idempotency breadcrumb: an external resource created during a run (wg peer,
+ * pve token, vmid …). Persisted before the creating step advances.
+ */
+class RunResource extends Model
+{
+    public const UPDATED_AT = null;
+
+    protected $fillable = ['run_id', 'host_id', 'kind', 'external_id'];
+
+    public function run(): BelongsTo
+    {
+        return $this->belongsTo(ProvisioningRun::class, 'run_id');
+    }
+
+    public function host(): BelongsTo
+    {
+        return $this->belongsTo(Host::class, 'host_id');
+    }
+}

app/Models/Seat.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Models;
+
+use App\Models\Concerns\HasUuid;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class Seat extends Model
+{
+    /** @use HasFactory<\Database\Factories\SeatFactory> */
+    use HasFactory, HasUuid;
+
+    public const ROLES = ['owner', 'admin', 'member', 'readonly'];
+
+    protected $fillable = ['customer_id', 'email', 'name', 'role', 'status', 'invited_at'];
+
+    protected function casts(): array
+    {
+        return ['invited_at' => 'datetime'];
+    }
+
+    public function customer(): BelongsTo
+    {
+        return $this->belongsTo(Customer::class);
+    }
+}

app/Models/StripePendingEvent.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+
+/**
+ * A billing event held until the contract it is about exists.
+ *
+ * See the migration for why: Stripe does not guarantee delivery order, and
+ * answering 2xx to an event we cannot match yet would drop it for good.
+ */
+class StripePendingEvent extends Model
+{
+    protected $guarded = [];
+
+    protected function casts(): array
+    {
+        return [
+            'payload' => 'array',
+            'raised_at' => 'datetime',
+        ];
+    }
+}

app/Models/Subscription.php

@@ -0,0 +1,204 @@
+<?php
+
+namespace App\Models;
+
+use App\Services\Billing\PlanCatalogue;
+use Illuminate\Database\Eloquent\Concerns\HasUuids;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+use RuntimeException;
+
+class Subscription extends Model
+{
+    use HasFactory;
+    use HasUuids;
+
+    public const TERM_MONTHLY = 'monthly';
+
+    public const TERM_YEARLY = 'yearly';
+
+    /**
+     * The conditions the customer is owed. Changing any of these after the fact
+     * would rewrite a contract, so the model refuses — a price rise applies to
+     * new subscriptions, never to existing ones.
+     */
+    public const FROZEN = [
+        'plan', 'plan_version_id', 'term', 'price_cents', 'currency', 'quota_gb', 'traffic_gb',
+        'seats', 'ram_mb', 'cores', 'disk_gb', 'performance', 'tier', 'started_at',
+    ];
+
+    protected $guarded = [];
+
+    protected static function booted(): void
+    {
+        static::updating(function (self $subscription) {
+            $frozen = array_intersect(array_keys($subscription->getDirty()), self::FROZEN);
+
+            if ($frozen !== []) {
+                throw new RuntimeException(
+                    'A subscription snapshot is immutable; tried to change: '.implode(', ', $frozen).
+                    '. Cancel this subscription and start a new one instead.'
+                );
+            }
+        });
+    }
+
+    protected function casts(): array
+    {
+        return [
+            'price_cents' => 'integer',
+            'quota_gb' => 'integer',
+            'traffic_gb' => 'integer',
+            'seats' => 'integer',
+            'ram_mb' => 'integer',
+            'cores' => 'integer',
+            'disk_gb' => 'integer',
+            'template_vmid' => 'integer',
+            'tier' => 'integer',
+            'started_at' => 'datetime',
+            'current_period_start' => 'datetime',
+            'current_period_end' => 'datetime',
+            'pending_effective_at' => 'datetime',
+            'cancelled_at' => 'datetime',
+            'stripe_event_at' => 'datetime',
+        ];
+    }
+
+    public function uniqueIds(): array
+    {
+        return ['uuid'];
+    }
+
+    public function customer(): BelongsTo
+    {
+        return $this->belongsTo(Customer::class);
+    }
+
+    public function order(): BelongsTo
+    {
+        return $this->belongsTo(Order::class);
+    }
+
+    /** Which version of the plan this contract was sold under. */
+    public function planVersion(): BelongsTo
+    {
+        return $this->belongsTo(PlanVersion::class, 'plan_version_id');
+    }
+
+    /** Modules booked onto this contract, each frozen at its booked price. */
+    public function addons(): HasMany
+    {
+        return $this->hasMany(SubscriptionAddon::class);
+    }
+
+    /** Every commercial event this contract has been through. */
+    public function records(): HasMany
+    {
+        return $this->hasMany(SubscriptionRecord::class);
+    }
+
+    public function instance(): BelongsTo
+    {
+        return $this->belongsTo(Instance::class);
+    }
+
+    /** Whether the catalogue still sells this plan at all. */
+    public static function knowsPlan(string $plan): bool
+    {
+        return app(PlanCatalogue::class)->isSellable($plan);
+    }
+
+    /** The single currency every catalogue price is expressed in. */
+    public static function catalogueCurrency(): string
+    {
+        return strtoupper((string) config('provisioning.currency', 'EUR'));
+    }
+
+    /**
+     * Take the version on sale right now and freeze it onto a new subscription.
+     *
+     * Reads the catalogue tables, never config: there is one source, and it is
+     * the one the owner can actually edit. An unknown, withdrawn or unpriced
+     * plan throws rather than returning something plausible — a contract opened
+     * from a guess is worse than a purchase that visibly fails.
+     */
+    public static function snapshotFrom(string $plan, string $term = self::TERM_MONTHLY, ?int $versionId = null): array
+    {
+        // A typo would otherwise be priced monthly while carrying an unknown
+        // term — a subscription whose price and billing period disagree.
+        if (! in_array($term, [self::TERM_MONTHLY, self::TERM_YEARLY], true)) {
+            throw new RuntimeException("Unknown term: {$term}");
+        }
+
+        // Honour the version the customer was actually shown, even if it has
+        // stopped being sold since — a checkout that completes just after a
+        // scheduled transition must not contract them to terms they never saw.
+        $version = $versionId !== null
+            ? app(PlanCatalogue::class)->soldVersion($plan, $versionId)
+            : app(PlanCatalogue::class)->currentVersion($plan);
+        $price = $version->priceFor($term);
+
+        if ($price === null) {
+            throw new RuntimeException("Plan '{$plan}' is not sold on a {$term} term.");
+        }
+
+        return [
+            'plan' => $plan,
+            // Which version this contract was sold under. A historical
+            // reference resolved by plan NAME would hand back today's terms.
+            'plan_version_id' => $version->id,
+            'term' => $term,
+            'price_cents' => $price->amount_cents,
+            'currency' => $price->currency,
+            'quota_gb' => $version->quota_gb,
+            'traffic_gb' => $version->traffic_gb,
+            'seats' => $version->seats,
+            'ram_mb' => $version->ram_mb,
+            'cores' => $version->cores,
+            'disk_gb' => $version->disk_gb,
+            'performance' => $version->performance,
+            // Copied so provisioning never has to ask the catalogue what to
+            // clone. Not in FROZEN — see the migration for why.
+            'template_vmid' => $version->template_vmid,
+            // Frozen too: which direction a later change goes must not depend
+            // on where the plan sits in today's catalogue.
+            'tier' => (int) $version->family->tier,
+        ];
+    }
+
+    public function isYearly(): bool
+    {
+        return $this->term === self::TERM_YEARLY;
+    }
+
+    /**
+     * What this contract works out to per month.
+     *
+     * `price_cents` is the price of a TERM, and a yearly term holds the whole
+     * year. Everything that prints a monthly figure — the plan card, the cloud
+     * page, the revenue column — has to divide, and every one of them getting
+     * it right separately is not something to rely on.
+     */
+    public function monthlyPriceCents(): int
+    {
+        return $this->isYearly()
+            ? (int) round($this->price_cents / 12)
+            : (int) $this->price_cents;
+    }
+
+    /**
+     * The whole monthly bill, net: the plan plus every module still booked.
+     *
+     * All of it frozen — that is the owner's rule. A total assembled from the
+     * contract for the plan and from today's catalogue for the modules would
+     * protect half a customer's price and quietly re-price the other half.
+     */
+    public function totalMonthlyCents(): int
+    {
+        return $this->monthlyPriceCents() + $this->addons
+            ->where('cancelled_at', null)
+            ->sum(fn (SubscriptionAddon $addon) => $addon->monthlyCents());
+    }
+}

app/Models/SubscriptionAddon.php

@@ -0,0 +1,84 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Concerns\HasUuids;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use RuntimeException;
+
+/**
+ * One booked module, at the price it was booked at.
+ *
+ * Frozen for the same reason the subscription is: the customer agreed to a
+ * figure, and raising it afterwards would rewrite that agreement. Cancelling
+ * sets `cancelled_at` rather than deleting the row — what someone was paying,
+ * and until when, is evidence.
+ */
+class SubscriptionAddon extends Model
+{
+    use HasFactory;
+    use HasUuids;
+
+    /** What the customer agreed to. */
+    public const FROZEN = ['subscription_id', 'addon_key', 'price_cents', 'currency', 'quantity', 'booked_at'];
+
+    protected $guarded = [];
+
+    protected static function booted(): void
+    {
+        static::updating(function (self $addon) {
+            $frozen = array_intersect(array_keys($addon->getDirty()), self::FROZEN);
+
+            if ($frozen !== []) {
+                throw new RuntimeException(
+                    'A booked module is frozen at its booked price; tried to change: '.implode(', ', $frozen).
+                    '. Cancel it and book it again at today\'s price instead.'
+                );
+            }
+        });
+    }
+
+    protected function casts(): array
+    {
+        return [
+            'price_cents' => 'integer',
+            'quantity' => 'integer',
+            'booked_at' => 'datetime',
+            'cancelled_at' => 'datetime',
+        ];
+    }
+
+    public function uniqueIds(): array
+    {
+        return ['uuid'];
+    }
+
+    public function subscription(): BelongsTo
+    {
+        return $this->belongsTo(Subscription::class);
+    }
+
+    public function order(): BelongsTo
+    {
+        return $this->belongsTo(Order::class);
+    }
+
+    public function scopeActive(Builder $query): Builder
+    {
+        return $query->whereNull('cancelled_at');
+    }
+
+    /** Net per month for this booking, packs included. */
+    public function monthlyCents(): int
+    {
+        return $this->price_cents * $this->quantity;
+    }
+
+    public function isActive(): bool
+    {
+        return $this->cancelled_at === null;
+    }
+}

app/Models/SubscriptionRecord.php

@@ -0,0 +1,118 @@
+<?php
+
+namespace App\Models;
+
+use App\Models\Builders\AppendOnlyBuilder;
+use Illuminate\Database\Eloquent\Concerns\HasUuids;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use RuntimeException;
+
+/**
+ * One commercial event, written once and never again.
+ *
+ * A register that can be edited proves nothing. So the model refuses updates
+ * and deletes outright: a mistake is corrected by recording the correction,
+ * which is how ledgers have always worked and why they can be trusted.
+ */
+class SubscriptionRecord extends Model
+{
+    use HasFactory;
+    use HasUuids;
+
+    public const EVENT_PURCHASE = 'purchase';
+
+    public const EVENT_UPGRADE = 'upgrade';
+
+    public const EVENT_DOWNGRADE = 'downgrade';
+
+    /** A term that renewed and was paid. Stripe's invoice says so. */
+    public const EVENT_RENEWAL = 'renewal';
+
+    /** A renewal Stripe could not collect. Their dunning takes it from here. */
+    public const EVENT_PAYMENT_FAILED = 'payment_failed';
+
+    /**
+     * A paid invoice that is not a cycle renewal — a proration, or a charge
+     * raised by hand. Money received, so it belongs in the register, but it
+     * does not start a new term and must not move the period.
+     */
+    public const EVENT_INVOICE_PAID = 'invoice_paid';
+
+    public const EVENT_ADDON_BOOKED = 'addon_booked';
+
+    public const EVENT_ADDON_CANCELLED = 'addon_cancelled';
+
+    public const EVENT_CANCELLATION = 'cancellation';
+
+    /** The shape of the `snapshot` column. Bump when it changes. */
+    public const SNAPSHOT_VERSION = 1;
+
+    protected $guarded = [];
+
+    protected static function booted(): void
+    {
+        static::updating(function () {
+            throw new RuntimeException(
+                'The proof register is append-only. Record a correcting event instead of editing history.'
+            );
+        });
+
+        static::deleting(function () {
+            throw new RuntimeException(
+                'The proof register is append-only. A record that can be deleted is not evidence.'
+            );
+        });
+    }
+
+    protected function casts(): array
+    {
+        return [
+            'net_cents' => 'integer',
+            'tax_cents' => 'integer',
+            'gross_cents' => 'integer',
+            'tax_rate' => 'decimal:2',
+            'reverse_charge' => 'boolean',
+            'plan_version' => 'integer',
+            'snapshot_version' => 'integer',
+            'snapshot' => 'array',
+            'occurred_at' => 'datetime',
+        ];
+    }
+
+    public function uniqueIds(): array
+    {
+        return ['uuid'];
+    }
+
+    /**
+     * The model events above only fire for instance operations. A bulk
+     * `query()->update()` or `->delete()` would sail straight past them, so the
+     * builder refuses those too.
+     */
+    public function newEloquentBuilder($query): AppendOnlyBuilder
+    {
+        return new AppendOnlyBuilder($query);
+    }
+
+    public function customer(): BelongsTo
+    {
+        return $this->belongsTo(Customer::class);
+    }
+
+    public function subscription(): BelongsTo
+    {
+        return $this->belongsTo(Subscription::class);
+    }
+
+    public function order(): BelongsTo
+    {
+        return $this->belongsTo(Order::class);
+    }
+
+    public function planVersion(): BelongsTo
+    {
+        return $this->belongsTo(PlanVersion::class, 'plan_version_id');
+    }
+}

app/Models/User.php

@@ -9,13 +9,24 @@ use Illuminate\Database\Eloquent\Attributes\Hidden;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Illuminate\Notifications\Notifiable;
+use Laravel\Fortify\TwoFactorAuthenticatable;
+use Spatie\Permission\Traits\HasRoles;
 
-#[Fillable(['name', 'email', 'password'])]
-#[Hidden(['password', 'remember_token'])]
+#[Fillable(['name', 'email', 'password', 'is_admin'])]
+#[Hidden(['password', 'remember_token', 'two_factor_secret', 'two_factor_recovery_codes'])]
 class User extends Authenticatable
 {
     /** @use HasFactory<UserFactory> */
-    use HasFactory, Notifiable;
+    use HasFactory, HasRoles, Notifiable, TwoFactorAuthenticatable;
+
+    /** The five operator roles that grant access to the admin console. */
+    public const OPERATOR_ROLES = ['Owner', 'Admin', 'Support', 'Billing', 'Read-only', 'Developer'];
+
+    /** True when this user holds an operator role (the RBAC console boundary). */
+    public function isOperator(): bool
+    {
+        return $this->hasAnyRole(self::OPERATOR_ROLES);
+    }
 
     /**
      * Get the attributes that should be cast.
@@ -27,6 +38,7 @@ class User extends Authenticatable
         return [
             'email_verified_at' => 'datetime',
             'password' => 'hashed',
+            'is_admin' => 'boolean',
         ];
     }
 }

app/Models/VpnPeer.php

@@ -0,0 +1,111 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Concerns\HasUuids;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\SoftDeletes;
+
+class VpnPeer extends Model
+{
+    use HasFactory;
+    use HasUuids;
+    use SoftDeletes;
+
+    /** A tunnel is considered live if the last handshake is recent. WireGuard
+     *  re-handshakes about every two minutes, so three is the first value that
+     *  does not flap for an idle-but-connected peer. */
+    public const ONLINE_AFTER_MINUTES = 3;
+
+    /** A person's access. Requires an owner. */
+    public const KIND_STAFF = 'staff';
+
+    /** Registered by the host pipeline for a Proxmox host. Requires host_id. */
+    public const KIND_HOST = 'host';
+
+    /** Found on the interface without a match — adopted so it stays visible. */
+    public const KIND_SYSTEM = 'system';
+
+    protected $guarded = [];
+
+    protected function casts(): array
+    {
+        return [
+            'enabled' => 'boolean',
+            'present' => 'boolean',
+            'last_handshake_at' => 'datetime',
+            'secret_purged_at' => 'datetime',
+            'last_downloaded_at' => 'datetime',
+            'observed_at' => 'datetime',
+            'rx_bytes' => 'integer',
+            'tx_bytes' => 'integer',
+        ];
+    }
+
+    public function uniqueIds(): array
+    {
+        return ['uuid'];
+    }
+
+    public function host(): BelongsTo
+    {
+        return $this->belongsTo(Host::class);
+    }
+
+    public function creator(): BelongsTo
+    {
+        return $this->belongsTo(User::class, 'created_by');
+    }
+
+    /** The person this access belongs to (staff peers only). */
+    public function owner(): BelongsTo
+    {
+        return $this->belongsTo(User::class, 'user_id');
+    }
+
+    public function hasStoredConfig(): bool
+    {
+        return $this->config_secret !== null;
+    }
+
+    /**
+     * Overwrite the stored credential. Called on revocation: a tombstone that
+     * still carries a usable private key is a liability, not a record.
+     */
+    public function purgeSecret(): void
+    {
+        if ($this->config_secret === null) {
+            return;
+        }
+
+        $this->forceFill(['config_secret' => null, 'secret_purged_at' => now()])->saveQuietly();
+    }
+
+    public function isOnline(): bool
+    {
+        return $this->enabled
+            && $this->present
+            && $this->last_handshake_at !== null
+            && $this->last_handshake_at->gt(now()->subMinutes(self::ONLINE_AFTER_MINUTES));
+    }
+
+    /**
+     * blocked  — operator revoked it; it must not be on the hub
+     * pending  — desired and observed state disagree; a job is still applying it
+     * online   — configured and handshaking
+     * idle     — configured, but no recent handshake
+     */
+    public function status(): string
+    {
+        if (! $this->enabled) {
+            return $this->present ? 'pending' : 'blocked';
+        }
+        if (! $this->present) {
+            return 'pending';
+        }
+
+        return $this->isOnline() ? 'online' : 'idle';
+    }
+}

app/Notifications/CloudReady.php

@@ -0,0 +1,49 @@
+<?php
+
+namespace App\Notifications;
+
+use App\Models\Instance;
+use Illuminate\Bus\Queueable;
+use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Notifications\Notification;
+use Illuminate\Support\Facades\Crypt;
+
+/**
+ * Delivers the initial admin credentials once provisioning completes.
+ *
+ * Sent SYNCHRONOUSLY from CompleteProvisioning (not queued): the step only
+ * records the `credentials_sent` breadcrumb and scrubs the password AFTER the
+ * send returns, so a mail failure re-runs the step (password preserved) instead
+ * of losing the credential in a failed queue job. Delivery is at-least-once — a
+ * crash in the tiny window after send but before the breadcrumb can re-send a
+ * duplicate welcome email, which is preferable to a lost credential.
+ */
+class CloudReady extends Notification
+{
+    use Queueable;
+
+    public function __construct(
+        public Instance $instance,
+        public string $adminUser,
+        public string $adminPasswordEncrypted, // ciphertext — safe to serialize into the queue
+    ) {}
+
+    /** @return array<int, string> */
+    public function via(object $notifiable): array
+    {
+        return ['mail'];
+    }
+
+    public function toMail(object $notifiable): MailMessage
+    {
+        $url = 'https://'.$this->instance->subdomain.'.'.config('provisioning.dns.zone');
+
+        return (new MailMessage)
+            ->subject(__('provisioning.mail.ready_subject'))
+            ->greeting(__('provisioning.mail.ready_greeting'))
+            ->line(__('provisioning.mail.ready_line'))
+            ->line(__('provisioning.mail.ready_user', ['user' => $this->adminUser]))
+            ->line(__('provisioning.mail.ready_password', ['password' => Crypt::decryptString($this->adminPasswordEncrypted)]))
+            ->action(__('provisioning.mail.ready_action'), $url);
+    }
+}

app/Policies/VpnPeerPolicy.php

@@ -0,0 +1,83 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\User;
+use App\Models\VpnPeer;
+
+/**
+ * Who may see and do what with a VPN access.
+ *
+ * Ownership is record-level and lives here; permissions describe elevated
+ * capabilities (vpn.view.all, vpn.manage.all) and are checked through Gate.
+ * The two are kept apart on purpose: seeing an access is not managing it, and
+ * neither of them is holding its private key.
+ *
+ * There is no Gate::before super-admin shortcut in this application, so these
+ * rules are the whole story — in particular downloadConfig() cannot be
+ * out-voted by a role.
+ */
+class VpnPeerPolicy
+{
+    public function viewAny(User $user): bool
+    {
+        // Every operator may at least reach the page to find their own access.
+        return $user->isOperator();
+    }
+
+    public function view(User $user, VpnPeer $peer): bool
+    {
+        return $this->owns($user, $peer) || $user->can('vpn.view.all');
+    }
+
+    public function create(User $user): bool
+    {
+        // Not self-service: an access reaches the management network, so issuing
+        // one is an administrative act even for oneself.
+        return $user->can('vpn.manage.all');
+    }
+
+    /** Rename, reassign, change stored-config settings. */
+    public function update(User $user, VpnPeer $peer): bool
+    {
+        return $user->can('vpn.manage.all');
+    }
+
+    /** Block / unblock. Owners may switch their own access off and on again. */
+    public function block(User $user, VpnPeer $peer): bool
+    {
+        return $user->can('vpn.manage.all') || $this->owns($user, $peer);
+    }
+
+    public function delete(User $user, VpnPeer $peer): bool
+    {
+        return $user->can('vpn.manage.all') || $this->owns($user, $peer);
+    }
+
+    /**
+     * The private half of someone's credential. Owner only — explicitly NOT
+     * vpn.view.all and NOT vpn.manage.all: an administrator who needs access
+     * revokes this one and issues themselves their own, which keeps the record
+     * of who holds what intact.
+     */
+    public function downloadConfig(User $user, VpnPeer $peer): bool
+    {
+        return $this->owns($user, $peer)
+            && $peer->config_secret !== null
+            && ! $peer->trashed();
+    }
+
+    /**
+     * isOperator() is part of ownership on purpose: roles can be taken away by
+     * other paths than revokeStaff() — a direct role edit, for instance. Losing
+     * the console must close these doors by itself, not rely on whoever removed
+     * the role also remembering the tunnel.
+     */
+    private function owns(User $user, VpnPeer $peer): bool
+    {
+        return $user->isOperator()
+            && $peer->kind === VpnPeer::KIND_STAFF
+            && $peer->user_id !== null
+            && $peer->user_id === $user->id;
+    }
+}

app/Providers/AppServiceProvider.php

@@ -2,7 +2,32 @@
 
 namespace App\Providers;
 
+use App\Provisioning\PipelineRegistry;
+use App\Services\Dns\HetznerDnsClient;
+use App\Services\Dns\HttpHetznerDnsClient;
+use App\Services\Monitoring\HttpMonitoringClient;
+use App\Services\Monitoring\MonitoringClient;
+use App\Services\Proxmox\HttpProxmoxClient;
+use App\Services\Proxmox\ProxmoxClient;
+use App\Services\Stripe\HttpStripeClient;
+use App\Services\Stripe\StripeClient;
+use App\Services\Ssh\PhpseclibRemoteShell;
+use App\Services\Ssh\RemoteShell;
+use App\Services\Traefik\SshTraefikWriter;
+use App\Services\Traefik\TraefikWriter;
+use App\Services\Wireguard\LocalWireguardHub;
+use App\Services\Wireguard\WireguardHub;
+use App\Http\Middleware\EnsureAdmin;
+use App\Http\Middleware\EnsureCustomerActive;
+use App\Http\Middleware\RestrictAdminHost;
+use App\Mail\MaintenanceCancelledMail;
+use App\Models\MaintenanceNotification;
+use App\Services\Maintenance\MaintenanceNotifier;
+use Illuminate\Mail\Events\MessageSending;
+use Illuminate\Mail\Events\MessageSent;
+use Illuminate\Support\Facades\Event;
 use Illuminate\Support\ServiceProvider;
+use Livewire\Livewire;
 
 class AppServiceProvider extends ServiceProvider
 {
@@ -11,7 +36,18 @@ class AppServiceProvider extends ServiceProvider
      */
     public function register(): void
     {
-        //
+        $this->app->singleton(PipelineRegistry::class, fn () => new PipelineRegistry(
+            config('provisioning.pipelines', []),
+        ));
+
+        // Real I/O implementations; tests swap in fakes via app()->instance().
+        $this->app->bind(RemoteShell::class, PhpseclibRemoteShell::class);
+        $this->app->bind(WireguardHub::class, LocalWireguardHub::class);
+        $this->app->bind(ProxmoxClient::class, HttpProxmoxClient::class);
+        $this->app->bind(HetznerDnsClient::class, HttpHetznerDnsClient::class);
+        $this->app->bind(TraefikWriter::class, SshTraefikWriter::class);
+        $this->app->bind(MonitoringClient::class, HttpMonitoringClient::class);
+        $this->app->bind(StripeClient::class, HttpStripeClient::class);
     }
 
     /**
@@ -19,6 +55,79 @@ class AppServiceProvider extends ServiceProvider
      */
     public function boot(): void
     {
+        // Livewire posts every component action to /livewire/update, which a
+        // path-based guard would skip. Marking the host restriction persistent
+        // makes Livewire re-apply it from the component's original route, so an
+        // admin action cannot be driven through a public hostname.
+        // Livewire re-applies only the middleware on this list when an action
+        // posts to /livewire/update. Its own defaults cover `auth` — but not
+        // ours. Without these two, a signed-in NON-operator could drive console
+        // components, and a suspended customer could keep driving the portal:
+        // the page would never load for them, but the page is not where the
+        // actions run.
+        Livewire::addPersistentMiddleware([
+            RestrictAdminHost::class,
+            EnsureAdmin::class,
+            EnsureCustomerActive::class,
+        ]);
+
+        // Send-time guard for maintenance mail (X-CP-Notification carries the
+        // ledger id). Deliberately READ-ONLY — it never marks the row sent or
+        // claimed, because returning false makes Laravel treat the send as a
+        // successful cancellation: pre-claiming here would silently DROP a mail
+        // whose transport later fails and retries. It only suppresses a send that
+        // is definitively pointless: the window was cancelled, or a sibling copy
+        // already delivered (sent_at set). sent_at is recorded on real delivery
+        // in MessageSent, so nothing is ever lost.
         //
+        // Residual: two jobs whose MessageSending both fire before either's
+        // MessageSent (true simultaneous multi-worker send of a stale resend) can
+        // still both deliver. That cannot happen on the current single-worker
+        // log-mail setup; true exactly-once needs a transactional outbox + a
+        // dedicated delivery worker keyed on claimed_at, to be added with real mail.
+        Event::listen(MessageSending::class, function (MessageSending $event) {
+            $header = $event->message->getHeaders()->get('X-CP-Notification');
+            if ($header === null) {
+                return null;
+            }
+            $notification = MaintenanceNotification::query()->with('window')->find((int) $header->getBodyAsString());
+            if ($notification === null) {
+                return null;
+            }
+            if ($notification->sent_at !== null) {
+                return false; // already delivered — suppress a duplicate copy
+            }
+            if ($notification->event === 'announcement' && $notification->window?->state === 'cancelled') {
+                return false; // window cancelled meanwhile — do not deliver
+            }
+
+            return null;
+        });
+
+        // Stamp a maintenance-notification ledger row as delivered only once the
+        // mail is actually sent (the X-CP-Notification header carries the id).
+        // Until then sent_at stays null → the row is a retryable marker. If an
+        // announcement delivered for an already-cancelled window (the cancel race),
+        // queue a catch-up cancellation so that customer isn't left mis-informed.
+        Event::listen(MessageSent::class, function (MessageSent $event) {
+            $header = $event->message->getHeaders()->get('X-CP-Notification');
+            if ($header === null) {
+                return;
+            }
+            $notification = MaintenanceNotification::query()->with(['window', 'customer'])->find((int) $header->getBodyAsString());
+            if ($notification === null) {
+                return;
+            }
+            $notification->update(['sent_at' => now()]);
+
+            if ($notification->event === 'announcement' && $notification->window?->state === 'cancelled' && $notification->customer !== null) {
+                app(MaintenanceNotifier::class)->deliver(
+                    $notification->window,
+                    $notification->customer,
+                    'cancelled',
+                    new MaintenanceCancelledMail($notification->window, $notification->customer),
+                );
+            }
+        });
     }
 }

app/Providers/FortifyServiceProvider.php

@@ -0,0 +1,60 @@
+<?php
+
+namespace App\Providers;
+
+use App\Actions\Fortify\CreateNewUser;
+use App\Actions\Fortify\ResetUserPassword;
+use App\Actions\Fortify\UpdateUserPassword;
+use App\Actions\Fortify\UpdateUserProfileInformation;
+use Illuminate\Cache\RateLimiting\Limit;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\RateLimiter;
+use Illuminate\Support\ServiceProvider;
+use Illuminate\Support\Str;
+use Laravel\Fortify\Actions\RedirectIfTwoFactorAuthenticatable;
+use Laravel\Fortify\Fortify;
+
+class FortifyServiceProvider extends ServiceProvider
+{
+    /**
+     * Register any application services.
+     */
+    public function register(): void
+    {
+        //
+    }
+
+    /**
+     * Bootstrap any application services.
+     */
+    public function boot(): void
+    {
+        Fortify::createUsersUsing(CreateNewUser::class);
+        Fortify::updateUserProfileInformationUsing(UpdateUserProfileInformation::class);
+        Fortify::updateUserPasswordsUsing(UpdateUserPassword::class);
+        Fortify::resetUserPasswordsUsing(ResetUserPassword::class);
+        Fortify::redirectUserForTwoFactorAuthenticationUsing(RedirectIfTwoFactorAuthenticatable::class);
+
+        RateLimiter::for('login', function (Request $request) {
+            $throttleKey = Str::transliterate(Str::lower($request->input(Fortify::username())).'|'.$request->ip());
+
+            return Limit::perMinute(5)->by($throttleKey);
+        });
+
+        RateLimiter::for('two-factor', function (Request $request) {
+            return Limit::perMinute(5)->by($request->session()->get('login.id'));
+        });
+
+        // Registration is public (no per-account key), so throttle per IP to blunt
+        // signup spam / CPU-exhaustion via repeated password hashing.
+        RateLimiter::for('registration', fn (Request $request) => Limit::perMinute(10)->by($request->ip()));
+
+        RateLimiter::for('passkeys', function (Request $request) {
+            $credentialId = $request->input('credential.id');
+
+            return Limit::perMinute(10)->by(
+                ($credentialId ?: $request->session()->getId()).'|'.$request->ip()
+            );
+        });
+    }
+}

app/Provisioning/Contracts/ProvisioningStep.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Provisioning\Contracts;
+
+use App\Models\ProvisioningRun;
+use App\Provisioning\StepResult;
+
+/**
+ * One idempotent unit of a provisioning pipeline. Steps never call each other;
+ * they depend only on the run's state and the service interfaces they need.
+ */
+interface ProvisioningStep
+{
+    /** Stable snake_case identifier used in events and idempotency checks. */
+    public function key(): string;
+
+    /** i18n key for the display label, e.g. hosts.step.<key>. */
+    public function label(): string;
+
+    /** Seconds this step may run before the runner treats it as timed out. */
+    public function maxDuration(): int;
+
+    public function execute(ProvisioningRun $run): StepResult;
+}

app/Provisioning/Contracts/ProvisioningSubject.php

@@ -0,0 +1,12 @@
+<?php
+
+namespace App\Provisioning\Contracts;
+
+/**
+ * A polymorphic run subject (Host, Order …) that reacts when its run fails,
+ * so the runner can update domain state without knowing the concrete model.
+ */
+interface ProvisioningSubject
+{
+    public function onProvisioningFailed(): void;
+}