diff --git a/BACKLOG.md b/BACKLOG.md
index abf2763..d74f35c 100644
--- a/BACKLOG.md
+++ b/BACKLOG.md
@@ -24,13 +24,13 @@ cleared:    set when the owner clears a done task from the widget's done list (d
 - result: 2026-10-08 · feature/desktop-app-tests-ux · הקישורים והניווט ל-/clients הופנו לדשבורד (שמציג את הלקוחות)
 
 ## Associate form labels with their inputs (htmlFor/id)
-- status: proposed
+- status: done
 - added: 2026-10-08
 - priority: 3
 - complexity: medium
 - tokens: 80000
 - details: Forms in client/src (Login.jsx, Register.jsx, ClientModal.jsx, ProjectModal.jsx, TaskModal.jsx and other modals) render <label className="form-label"> as a sibling of the control with no htmlFor/id, so screen readers and Playwright getByLabel can't resolve them (e2e/helpers.js has a field() workaround). Add useId-based id/htmlFor pairs. Done when getByLabel('שם לקוח *') etc. resolve in the e2e specs, client unit tests and npm run test:e2e pass.
-- result:
+- result: 2026-10-08 · feature/backlog-fixes · כל התוויות בטפסים ובמודאלים מקושרות לשדות (useId), ה-e2e משתמש ב-getByLabel
 
 ## Make the closed mobile sidebar inert
 - status: done
@@ -42,73 +42,73 @@ cleared:    set when the owner clears a done task from the widget's done list (d
 - result: 2026-10-08 · feature/desktop-app-tests-ux · הסיידבר הסגור במובייל מקבל inert, כך שאינו נגיש ב-Tab ובקורא מסך
 
 ## Fix forced password reset bypass on login
-- status: proposed
+- status: done
 - added: 2026-10-08
 - priority: 1
 - complexity: medium
 - tokens: 200000
 - details: client/src/App.jsx GuestRoute + client/src/store/useStore.js:100 completeAuth: when the server answers requiresPasswordReset, completeAuth marks the user authenticated and GuestRoute redirects to / before Login.jsx opens its reset prompt, so the admin-forced reset never happens. Also the new-password prompt renders type=text (client/src/components/Modal/CustomModal.jsx:91 ignores the 'password' type passed from Login.jsx:93). Done when the it.fails tests in client/src/App.test.jsx pass as normal tests, the prompt masks the password, and client unit tests + npm run test:e2e pass.
-- result:
+- result: 2026-10-08 · feature/backlog-fixes · איפוס כפוי נאכף גם בשרת (token ייעודי ל-15 דקות, אין session לפני האיפוס), שדה הסיסמה מוסתר, הגבלת ניסיונות
 
 ## Make addon enablement per workspace, not per user
-- status: proposed
+- status: done
 - added: 2026-10-08
 - priority: 2
 - complexity: medium
 - tokens: 200000
 - details: server/database.js:409 user_addons has UNIQUE(user_id, addon_id), so a member of two workspaces gets a 500 when enabling the same addon in the second one. Rebuild the table with UNIQUE(workspace_id, addon_id) in a migration that keeps existing rows (back up first). Done when the it.fails test 'a member of two workspaces can toggle the same addon in both' in server/tests/catalog-sources-addons.test.js passes as a normal test and npm --prefix server test is green.
-- result:
+- result: 2026-10-08 · feature/backlog-fixes · מפתח ייחודי (workspace_id, addon_id) עם migration שנבדק על עותק; גם integrations
 
 ## Stop account deletion and workspace deletion from orphaning or wiping shared data
-- status: proposed
+- status: done
 - added: 2026-10-08
 - priority: 2
 - complexity: medium
 - tokens: 200000
 - details: server/database.js: clients.user_id is ON DELETE CASCADE, so a member deleting their account wipes clients (and their projects/entries) they created in someone else's workspace; deleting a workspace (server/routes/workspaces.js:154) leaves its clients/projects/entries orphaned because workspace_id has no FK. Decide ownership by workspace: reassign or keep shared records, and delete workspace-scoped rows explicitly when a workspace is deleted. Done when the two it.fails tests in server/tests/auth-profile-admin.test.js:113 and server/tests/workspaces-isolation.test.js:380 pass as normal tests.
-- result:
+- result: 2026-10-08 · feature/backlog-fixes · מחיקת workspace מוחקת את כל הנתונים שלו; מחיקת חשבון מעבירה רשומות משותפות לבעלים
 
 ## Fix monthly recurrence on the 29th-31st
-- status: proposed
+- status: done
 - added: 2026-10-08
 - priority: 3
 - complexity: low
 - tokens: 100000
 - details: server/routes/reminders.js:217 and server/routes/planned-slots.js:38 use setMonth for monthly repeats, which overflows into the next month when the start day is 29-31 (Jan 31 -> Mar 3). Clamp to the last day of the target month. Also planned-slots.js:115 should 400 when the series end is before the start. Done when the three it.fails tests in server/tests/reminders-alerts-slots.test.js pass as normal tests.
-- result:
+- result: 2026-10-08 · feature/backlog-fixes · קיטום לסוף חודש עם שמירת היום המקורי (recurrence_day), ו-400 לסדרה שמסתיימת לפני תחילתה
 
 ## Small API validation gaps found by the test suite
-- status: proposed
+- status: done
 - added: 2026-10-08
 - priority: 3
 - complexity: low
 - tokens: 100000
 - details: Fix the remaining it.fails cases: credentials PUT wipes omitted fields (server/routes/credentials.js:190), quick status change away from paid keeps paid_date (server/routes/payments.js:494), expenses PUT accepts amount <= 0 (server/routes/expenses.js:265), catalog price 0 stored as NULL (server/routes/catalog.js:76,112). Done when those it.fails tests in server/tests pass as normal tests and npm --prefix server test is green.
-- result:
+- result: 2026-10-08 · feature/backlog-fixes · credentials/payments/expenses/catalog: שדות שלא נשלחו נשמרים, paid_date מתנקה, סכום לא חיובי נדחה, מחיר 0 נשמר
 
 ## Restrict who can manage global client sources and addon keys
-- status: proposed
+- status: done
 - added: 2026-10-08
 - priority: 2
 - complexity: medium
 - tokens: 200000
 - details: server/routes/client_sources.js:99,120 lets any user create a global source (visible to all workspaces) or claim a global one for their workspace; server/routes/addons.js lets any workspace member, any role, change addon API keys. Limit global sources to system admins and addon secrets to workspace owner/admin. Done when new tests in server/tests/catalog-sources-addons.test.js cover both rules and the suite is green.
-- result:
+- result: 2026-10-08 · feature/backlog-fixes · מקורות גלובליים רק לאדמין מערכת; תוספים ומפתחות API רק לבעלים/מנהל
 
 ## Agree on day boundaries between StatsBar and the stats API
-- status: proposed
+- status: done
 - added: 2026-10-08
 - priority: 3
 - complexity: medium
 - tokens: 200000
 - details: client/src/components/StatsBar.jsx sends date ranges as UTC midnight while server/routes/stats.js:91-94 rounds to UTC days, so in Israel the dashboard range is shifted by 2-3 hours. Pick one rule (local day boundaries sent as ISO with offset is the natural one), apply it on both sides, and add tests on both sides. Done when a range for 'today' in Asia/Jerusalem counts an entry at 01:00 local time.
-- result:
+- result: 2026-10-08 · feature/backlog-fixes · טווחים וחודשים נשלחים כרגעים מקומיים והשרת משתמש בהם כמו שהם
 
 ## Split the client bundle per route
-- status: proposed
+- status: done
 - added: 2026-10-08
 - priority: 3
 - complexity: medium
 - tokens: 200000
 - details: client is a single 1MB JS chunk. Convert the page imports in client/src/App.jsx to React.lazy with Suspense around the Layout Outlet. Caution: page CSS files define classes used by other pages, so keep CSS in one file (vite build.cssCodeSplit: false) and keep the import order, then compare screenshots of every route before/after. Done when the main chunk is under 500kB and npm run test:e2e passes.
-- result:
+- result: 2026-10-08 · feature/backlog-fixes · React.lazy לכל העמודים, CSS אחד באותו סדר; החבילה הראשית ירדה מ-1,026kB ל-412kB
diff --git a/client/src/App.jsx b/client/src/App.jsx
index 26c4a27..155b531 100644
--- a/client/src/App.jsx
+++ b/client/src/App.jsx
@@ -1,41 +1,67 @@
-import { useEffect, useState } from 'react';
+import { lazy, useEffect, useState } from 'react';
 import { Routes, Route, Navigate, Link } from 'react-router-dom';
 import { authAPI } from './services/api';
 import useStore from './store/useStore';
 import { ModalProvider } from './components/Modal';
 import { TimerSyncProvider } from './components/TimerSyncProvider';
 import ErrorBoundary from './components/ErrorBoundary';
+import RouteSuspense from './components/RouteSuspense';
 
 // Layout
 import Layout from './components/Layout';
 import AuthLayout from './components/AuthLayout';
 
-// Pages
+// Pages on the first screen a user sees stay in the main bundle
 import Login from './pages/Login';
 import Register from './pages/Register';
 import Dashboard from './pages/Dashboard';
-import ClientDetail from './pages/ClientDetail';
-import Projects from './pages/Projects';
-import ProjectDetail from './pages/ProjectDetail';
-import TaskDetail from './pages/TaskDetail';
-import Tasks from './pages/Tasks';
-import Profile from './pages/Profile';
-import SharedClient from './pages/SharedClient';
-import SharedProject from './pages/SharedProject';
-import SharedAccess from './pages/SharedAccess';
-import SharedWithMe from './pages/SharedWithMe';
-import Reminders from './pages/Reminders';
-import AdminPanel from './pages/AdminPanel';
-import SettingsPage from './pages/SettingsPage';
-import CredentialsPage from './pages/CredentialsPage';
-import LeadsManagement from './pages/LeadsManagement';
-import LeadDetail from './pages/LeadDetail';
-import TimeEntries from './pages/TimeEntries';
-import Payments from './pages/Payments';
-import Schedule from './pages/Schedule';
-import WorkspaceSettings from './pages/WorkspaceSettings';
-import JoinWorkspace from './pages/JoinWorkspace';
-import CatalogPage from './pages/CatalogPage';
+
+// The CSS of the lazy pages below, in its original cascade order (see routeStyles.js)
+import './routeStyles';
+
+// After a new build is deployed, an open tab still asks for the previous build's chunk files, which
+// are gone. Reload once to pick up the new build instead of showing the error screen.
+const RELOADED_FOR_CHUNK = 'clockwize:reloaded-for-chunk';
+const lazyPage = (load) => lazy(() => load().then(
+  (module) => {
+    try { sessionStorage.removeItem(RELOADED_FOR_CHUNK); } catch { /* storage unavailable */ }
+    return module;
+  },
+  (error) => {
+    let reloaded = true;
+    try {
+      reloaded = sessionStorage.getItem(RELOADED_FOR_CHUNK) === '1';
+      if (!reloaded) sessionStorage.setItem(RELOADED_FOR_CHUNK, '1');
+    } catch { /* storage unavailable - don't risk a reload loop */ }
+    if (reloaded) throw error;
+    window.location.reload();
+    return new Promise(() => {});
+  }
+));
+
+// Every other page is split into its own chunk, loaded on first visit
+const ClientDetail = lazyPage(() => import('./pages/ClientDetail'));
+const Projects = lazyPage(() => import('./pages/Projects'));
+const ProjectDetail = lazyPage(() => import('./pages/ProjectDetail'));
+const TaskDetail = lazyPage(() => import('./pages/TaskDetail'));
+const Tasks = lazyPage(() => import('./pages/Tasks'));
+const Profile = lazyPage(() => import('./pages/Profile'));
+const SharedClient = lazyPage(() => import('./pages/SharedClient'));
+const SharedProject = lazyPage(() => import('./pages/SharedProject'));
+const SharedAccess = lazyPage(() => import('./pages/SharedAccess'));
+const SharedWithMe = lazyPage(() => import('./pages/SharedWithMe'));
+const Reminders = lazyPage(() => import('./pages/Reminders'));
+const AdminPanel = lazyPage(() => import('./pages/AdminPanel'));
+const SettingsPage = lazyPage(() => import('./pages/SettingsPage'));
+const CredentialsPage = lazyPage(() => import('./pages/CredentialsPage'));
+const LeadsManagement = lazyPage(() => import('./pages/LeadsManagement'));
+const LeadDetail = lazyPage(() => import('./pages/LeadDetail'));
+const TimeEntries = lazyPage(() => import('./pages/TimeEntries'));
+const Payments = lazyPage(() => import('./pages/Payments'));
+const Schedule = lazyPage(() => import('./pages/Schedule'));
+const WorkspaceSettings = lazyPage(() => import('./pages/WorkspaceSettings'));
+const JoinWorkspace = lazyPage(() => import('./pages/JoinWorkspace'));
+const CatalogPage = lazyPage(() => import('./pages/CatalogPage'));
 
 // Protected Route
 const ProtectedRoute = ({ children }) => {
@@ -138,6 +164,8 @@ function App() {
     <ErrorBoundary>
     <ModalProvider>
       <TimerSyncProvider>
+      {/* Pages inside Layout have their own boundary around the <Outlet>; this one covers the rest */}
+      <RouteSuspense fullPage>
       <Routes>
         {/* New unified share access (with password/email support) */}
         <Route path="/s/:token" element={<SharedAccess />} />
@@ -206,6 +234,7 @@ function App() {
         {/* Catch all */}
         <Route path="*" element={<Navigate to="/" replace />} />
       </Routes>
+      </RouteSuspense>
       </TimerSyncProvider>
     </ModalProvider>
     </ErrorBoundary>
diff --git a/client/src/App.test.jsx b/client/src/App.test.jsx
index e704bde..2d66111 100644
--- a/client/src/App.test.jsx
+++ b/client/src/App.test.jsx
@@ -3,11 +3,11 @@ import { render, screen, waitFor } from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
 import { MemoryRouter, useLocation } from 'react-router-dom';
 
-const login = vi.hoisted(() => vi.fn());
+const { login, resetPassword } = vi.hoisted(() => ({ login: vi.fn(), resetPassword: vi.fn() }));
 
 vi.mock('./services/api', async (importOriginal) => {
   const actual = await importOriginal();
-  return { ...actual, authAPI: { ...actual.authAPI, login } };
+  return { ...actual, authAPI: { ...actual.authAPI, login, resetPassword } };
 });
 vi.mock('@simplewebauthn/browser', () => ({
   startAuthentication: vi.fn(),
@@ -43,11 +43,13 @@ const loginThroughApp = async () => {
   await user.type(await screen.findByPlaceholderText('admin או your@email.com'), 'dana@example.com');
   await user.type(screen.getByPlaceholderText('••••••••'), 'old-password');
   await user.click(screen.getByRole('button', { name: 'התחבר' }));
+  return user;
 };
 
 beforeEach(() => {
   useStore.setState(initialState, true);
   login.mockReset();
+  resetPassword.mockReset();
   // Everything other than login goes through the real api module to a stubbed backend
   vi.stubGlobal('fetch', vi.fn(async () => ({
     ok: true,
@@ -69,14 +71,48 @@ describe('App routing around login', () => {
     expect(screen.queryByPlaceholderText('••••••••')).not.toBeInTheDocument();
   });
 
-  // completeAuth() sets isAuthenticated before Login can open the reset prompt, so GuestRoute
-  // (App.jsx) redirects to "/" and unmounts Login: a user the admin flagged for a forced
-  // password reset goes straight to the dashboard and is never asked to change it
-  it.fails('a user flagged for a forced password reset is asked for a new password first', async () => {
-    login.mockResolvedValue(loginResponse({ requiresPasswordReset: true }));
+  // The login response of a flagged user is not a session yet: GuestRoute must keep Login (and its
+  // reset prompt) on screen instead of redirecting to the dashboard
+  it('a user flagged for a forced password reset is asked for a new password first', async () => {
+    login.mockResolvedValue({ requiresPasswordReset: true, resetToken: 'reset-jwt' });
 
     await loginThroughApp();
 
     expect(await screen.findByRole('heading', { name: 'נדרש איפוס סיסמה' })).toBeInTheDocument();
+    expect(screen.getByLabelText('הזן סיסמה חדשה (לפחות 4 תווים):')).toHaveAttribute('type', 'password');
+    expect(screen.getByTestId('path')).toHaveTextContent(/^\/login$/);
+    expect(useStore.getState().isAuthenticated).toBe(false);
+    expect(localStorage.getItem('token')).toBeNull();
+  });
+
+  it('cancelling the forced reset keeps the user logged out on /login', async () => {
+    login.mockResolvedValue({ requiresPasswordReset: true, resetToken: 'reset-jwt' });
+
+    const user = await loginThroughApp();
+    await screen.findByRole('heading', { name: 'נדרש איפוס סיסמה' });
+    await user.click(screen.getByRole('button', { name: 'ביטול' }));
+
+    expect(await screen.findByText('חובה לשנות סיסמה כדי להמשיך')).toBeInTheDocument();
+    expect(screen.getByTestId('path')).toHaveTextContent(/^\/login$/);
+    expect(useStore.getState().isAuthenticated).toBe(false);
+    expect(localStorage.getItem('token')).toBeNull();
+  });
+
+  it('enters the app only after the new password was saved', async () => {
+    login.mockResolvedValue({ requiresPasswordReset: true, resetToken: 'reset-jwt' });
+    resetPassword.mockResolvedValue({ ...loginResponse(), token: 'jwt-after-reset' });
+
+    const user = await loginThroughApp();
+    await user.type(await screen.findByLabelText('הזן סיסמה חדשה (לפחות 4 תווים):'), 'new-password');
+    await user.click(screen.getByRole('button', { name: 'אישור' }));
+
+    expect(resetPassword).toHaveBeenCalledWith({ resetToken: 'reset-jwt', newPassword: 'new-password' });
+    expect(await screen.findByText('סיסמה שונתה בהצלחה!')).toBeInTheDocument();
+    expect(useStore.getState().isAuthenticated).toBe(false);
+    await user.click(screen.getByRole('button', { name: 'אישור' }));
+
+    await waitFor(() => expect(screen.getByTestId('path')).toHaveTextContent(/^\/$/));
+    expect(useStore.getState().isAuthenticated).toBe(true);
+    expect(localStorage.getItem('token')).toBe('jwt-after-reset');
   });
 });
diff --git a/client/src/apps/morning/Settings.jsx b/client/src/apps/morning/Settings.jsx
index 07f50db..710c433 100644
--- a/client/src/apps/morning/Settings.jsx
+++ b/client/src/apps/morning/Settings.jsx
@@ -1,4 +1,4 @@
-import { useState, useEffect, useRef } from 'react';
+import { useState, useEffect, useRef, useId } from 'react';
 import { Check, AlertCircle, Loader, Search, Settings, LogOut } from 'lucide-react';
 import api from '../../services/api';
 import '../../pages/Settings.css';
@@ -97,6 +97,7 @@ function SearchableSelect({ options, value, onChange, placeholder }) {
 }
 
 const MorningSettings = ({ integration, onUpdate }) => {
+    const uid = useId();
     const [connecting, setConnecting] = useState(false);
     const [apiKey, setApiKey] = useState('');
     const [apiSecret, setApiSecret] = useState('');
@@ -540,8 +541,9 @@ const MorningSettings = ({ integration, onUpdate }) => {
         <div className="integration-body">
             <form onSubmit={handleConnect} className="connect-form">
                 <div className="form-group">
-                    <label className="form-label">API Key (ID)</label>
+                    <label className="form-label" htmlFor={`${uid}-api-key`}>API Key (ID)</label>
                     <input
+                        id={`${uid}-api-key`}
                         type="text"
                         className="form-input"
                         value={apiKey}
@@ -551,8 +553,9 @@ const MorningSettings = ({ integration, onUpdate }) => {
                     />
                 </div>
                 <div className="form-group">
-                    <label className="form-label">API Secret</label>
+                    <label className="form-label" htmlFor={`${uid}-api-secret`}>API Secret</label>
                     <input
+                        id={`${uid}-api-secret`}
                         type="password"
                         className="form-input"
                         value={apiSecret}
diff --git a/client/src/components/AIAssistant/PlanCard.jsx b/client/src/components/AIAssistant/PlanCard.jsx
index b32c457..3bf0bc9 100644
--- a/client/src/components/AIAssistant/PlanCard.jsx
+++ b/client/src/components/AIAssistant/PlanCard.jsx
@@ -1,4 +1,4 @@
-import { useState } from 'react';
+import { useState, useId } from 'react';
 import { Check, User, Briefcase, ListTodo, CheckSquare, Bell, Edit2, X, Save, ChevronDown, ChevronUp } from 'lucide-react';
 
 // Type icons and labels
@@ -89,6 +89,7 @@ function PlanCard({ item, index, isSelected, onToggle, onUpdate }) {
   const [isEditing, setIsEditing] = useState(false);
   const [editData, setEditData] = useState({});
   const [isExpanded, setIsExpanded] = useState(false);
+  const uid = useId();
 
   const config = TYPE_CONFIG[item.type] || TYPE_CONFIG.task;
   const Icon = config.icon;
@@ -169,15 +170,17 @@ function PlanCard({ item, index, isSelected, onToggle, onUpdate }) {
         <div className="plan-card-edit-form">
           {config.fields.map(field => (
             <div key={field} className="plan-card-field">
-              <label>{FIELD_LABELS[field] || field}</label>
+              <label htmlFor={`${uid}-${field}`}>{FIELD_LABELS[field] || field}</label>
               {field === 'description' || field === 'notes' || field === 'content' ? (
                 <textarea
+                  id={`${uid}-${field}`}
                   value={editData[field] || ''}
                   onChange={(e) => handleFieldChange(field, e.target.value)}
                   rows={2}
                 />
               ) : field === 'pricing_type' ? (
                 <select
+                  id={`${uid}-${field}`}
                   value={editData[field] || 'hourly'}
                   onChange={(e) => handleFieldChange(field, e.target.value)}
                 >
@@ -186,6 +189,7 @@ function PlanCard({ item, index, isSelected, onToggle, onUpdate }) {
                 </select>
               ) : field === 'priority' ? (
                 <select
+                  id={`${uid}-${field}`}
                   value={editData[field] || 'normal'}
                   onChange={(e) => handleFieldChange(field, e.target.value)}
                 >
@@ -195,12 +199,14 @@ function PlanCard({ item, index, isSelected, onToggle, onUpdate }) {
                 </select>
               ) : field === 'due_date' ? (
                 <input
+                  id={`${uid}-${field}`}
                   type="datetime-local"
                   value={editData[field]?.slice(0, 16) || ''}
                   onChange={(e) => handleFieldChange(field, e.target.value)}
                 />
               ) : (
                 <input
+                  id={`${uid}-${field}`}
                   type={field.includes('rate') || field.includes('price') || field.includes('hours') ? 'number' : 'text'}
                   value={editData[field] || ''}
                   onChange={(e) => handleFieldChange(field, e.target.value)}
diff --git a/client/src/components/ActiveTimer.jsx b/client/src/components/ActiveTimer.jsx
index 527e42e..bff8b2a 100644
--- a/client/src/components/ActiveTimer.jsx
+++ b/client/src/components/ActiveTimer.jsx
@@ -1,4 +1,4 @@
-import { useState, useEffect, useCallback, useRef } from 'react';
+import { useState, useEffect, useCallback, useRef, useId } from 'react';
 import { createPortal } from 'react-dom';
 import { Link, useNavigate } from 'react-router-dom';
 import { Play, Pause, Square, X as XIcon, User, Timer, Plus, Trash2, Edit2, Link2 } from 'lucide-react';
@@ -220,6 +220,7 @@ function ActiveTimer({ isSidebar = false, isCollapsed = false }) {
   const updateTimerStartTime = useStore(s => s.updateTimerStartTime);
   const modal = useModal();
   const navigate = useNavigate();
+  const uid = useId();
   const [showStopModal, setShowStopModal] = useState(false);
   const [selectedTimer, setSelectedTimer] = useState(null);
   const [notes, setNotes] = useState('');
@@ -1095,8 +1096,9 @@ function ActiveTimer({ isSidebar = false, isCollapsed = false }) {
                 <>
                   {/* Client selector */}
                   <div className="form-group">
-                    <label className="form-label">לקוח</label>
+                    <label className="form-label" htmlFor={`${uid}-client`}>לקוח</label>
                     <select
+                      id={`${uid}-client`}
                       className="form-input"
                       value={selectedClientId}
                       onChange={handleClientChange}
@@ -1112,8 +1114,9 @@ function ActiveTimer({ isSidebar = false, isCollapsed = false }) {
 
                   {/* Project selector */}
                   <div className="form-group">
-                    <label className="form-label">פרויקט</label>
+                    <label className="form-label" htmlFor={`${uid}-project`}>פרויקט</label>
                     <select
+                      id={`${uid}-project`}
                       className="form-input"
                       value={showNewProject ? '__new__' : selectedProjectId}
                       onChange={handleProjectChange}
@@ -1156,8 +1159,9 @@ function ActiveTimer({ isSidebar = false, isCollapsed = false }) {
 
                   {/* Task selector */}
                   <div className="form-group">
-                    <label className="form-label">משימה (אופציונלי)</label>
+                    <label className="form-label" htmlFor={`${uid}-task`}>משימה (אופציונלי)</label>
                     <select
+                      id={`${uid}-task`}
                       className="form-input"
                       value={showNewTask ? '__new__' : selectedTaskId}
                       onChange={handleTaskChange}
@@ -1201,8 +1205,9 @@ function ActiveTimer({ isSidebar = false, isCollapsed = false }) {
                   {/* Subtask selector */}
                   {selectedTaskId && subtasks.length > 0 && (
                     <div className="form-group">
-                      <label className="form-label">תת-משימה (אופציונלי)</label>
+                      <label className="form-label" htmlFor={`${uid}-subtask`}>תת-משימה (אופציונלי)</label>
                       <select
+                        id={`${uid}-subtask`}
                         className="form-input"
                         value={selectedSubtaskId}
                         onChange={handleSubtaskChange}
@@ -1341,8 +1346,8 @@ function ActiveTimer({ isSidebar = false, isCollapsed = false }) {
                                   <span className="interval-edit-number">{index + 1}</span>
                                   
                                   <div className="interval-edit-fields">
-                                    <div className="interval-edit-row">
-                                      <label>התחלה:</label>
+                                    <div className="interval-edit-row" role="group" aria-labelledby={`${uid}-start-label-${index}`}>
+                                      <label id={`${uid}-start-label-${index}`}>התחלה:</label>
                                       <input
                                         type="date"
                                         value={interval.start_date_input || formatDateForInput(interval.start_time)}
@@ -1358,8 +1363,8 @@ function ActiveTimer({ isSidebar = false, isCollapsed = false }) {
                                         dir="ltr"
                                       />
                                     </div>
-                                    <div className="interval-edit-row">
-                                      <label>סיום:</label>
+                                    <div className="interval-edit-row" role="group" aria-labelledby={`${uid}-end-label-${index}`}>
+                                      <label id={`${uid}-end-label-${index}`}>סיום:</label>
                                       <input
                                         type="date"
                                         value={interval.end_date_input || formatDateForInput(interval.end_time)}
@@ -1418,8 +1423,9 @@ function ActiveTimer({ isSidebar = false, isCollapsed = false }) {
                   )}
 
                   <div className="form-group">
-                    <label className="form-label">הערות (אופציונלי)</label>
+                    <label className="form-label" htmlFor={`${uid}-notes`}>הערות (אופציונלי)</label>
                     <textarea 
+                      id={`${uid}-notes`}
                       className="form-input"
                       value={notes}
                       onChange={e => setNotes(e.target.value)}
@@ -1465,8 +1471,9 @@ function ActiveTimer({ isSidebar = false, isCollapsed = false }) {
             </div>
             <div className="modal-body">
               <div className="form-group">
-                <label className="form-label">תאריך</label>
+                <label className="form-label" htmlFor={`${uid}-edit-start-date`}>תאריך</label>
                 <input
+                  id={`${uid}-edit-start-date`}
                   type="date"
                   value={editStartDate}
                   onChange={(e) => setEditStartDate(e.target.value)}
@@ -1475,8 +1482,9 @@ function ActiveTimer({ isSidebar = false, isCollapsed = false }) {
                 />
               </div>
               <div className="form-group">
-                <label className="form-label">שעה</label>
+                <label className="form-label" htmlFor={`${uid}-edit-start-time`}>שעה</label>
                 <input
+                  id={`${uid}-edit-start-time`}
                   type="time"
                   value={editStartTime}
                   onChange={(e) => setEditStartTime(e.target.value)}
diff --git a/client/src/components/AlertModal.jsx b/client/src/components/AlertModal.jsx
index 2415c77..4a939ab 100644
--- a/client/src/components/AlertModal.jsx
+++ b/client/src/components/AlertModal.jsx
@@ -1,10 +1,11 @@
-import { useState, useEffect, useRef } from 'react';
+import { useState, useEffect, useRef, useId } from 'react';
 import { createPortal } from 'react-dom';
 import { X } from 'lucide-react';
 import useBodyScrollLock from '../hooks/useBodyScrollLock';
 
 function AlertModal({ alert, projectId, onSave, onClose }) {
   useBodyScrollLock(true);
+  const uid = useId();
   const formRef = useRef(null);
   const [formData, setFormData] = useState({
     alert_type: '',
@@ -69,8 +70,9 @@ function AlertModal({ alert, projectId, onSave, onClose }) {
         <form ref={formRef} onSubmit={handleSubmit}>
           <div className="modal-body">
             <div className="form-group">
-              <label className="form-label">סוג התראה *</label>
+              <label className="form-label" htmlFor={`${uid}-alert_type`}>סוג התראה *</label>
               <select
+                id={`${uid}-alert_type`}
                 name="alert_type"
                 className="form-input"
                 value={formData.alert_type}
@@ -87,10 +89,11 @@ function AlertModal({ alert, projectId, onSave, onClose }) {
 
             {showThresholdValue && (
               <div className="form-group">
-                <label className="form-label">
+                <label className="form-label" htmlFor={`${uid}-threshold_value`}>
                   {formData.alert_type === 'hours' ? 'סף שעות' : 'סף סכום (₪)'}
                 </label>
                 <input
+                  id={`${uid}-threshold_value`}
                   type="number"
                   name="threshold_value"
                   className="form-input"
@@ -107,8 +110,9 @@ function AlertModal({ alert, projectId, onSave, onClose }) {
 
             {showThresholdDays && (
               <div className="form-group">
-                <label className="form-label">מספר ימים לפני הדדליין</label>
+                <label className="form-label" htmlFor={`${uid}-threshold_days`}>מספר ימים לפני הדדליין</label>
                 <input
+                  id={`${uid}-threshold_days`}
                   type="number"
                   name="threshold_days"
                   className="form-input"
@@ -123,8 +127,9 @@ function AlertModal({ alert, projectId, onSave, onClose }) {
             )}
 
             <div className="form-group">
-              <label className="form-label">הערה / פעולה נדרשת</label>
+              <label className="form-label" htmlFor={`${uid}-message`}>הערה / פעולה נדרשת</label>
               <textarea
+                id={`${uid}-message`}
                 name="message"
                 className="form-input"
                 value={formData.message}
diff --git a/client/src/components/CatalogModal.jsx b/client/src/components/CatalogModal.jsx
index 45757fd..5e0ef10 100644
--- a/client/src/components/CatalogModal.jsx
+++ b/client/src/components/CatalogModal.jsx
@@ -1,9 +1,10 @@
-import { useState, useEffect } from 'react';
+import { useState, useEffect, useId } from 'react';
 import { createPortal } from 'react-dom';
 import { Package, X } from 'lucide-react';
 import './CatalogModal.css';
 
 function CatalogModal({ item, categories = [], onSave, onClose }) {
+  const uid = useId();
   const [formData, setFormData] = useState({
     name: '',
     description: '',
@@ -23,7 +24,7 @@ function CatalogModal({ item, categories = [], onSave, onClose }) {
       setFormData({
         name: item.name || '',
         description: item.description || '',
-        price: item.price || '',
+        price: item.price ?? '',
         pricing_type: item.pricing_type || 'fixed',
         unit: item.unit || '',
         category: item.category || '',
@@ -52,7 +53,8 @@ function CatalogModal({ item, categories = [], onSave, onClose }) {
     try {
       const data = {
         ...formData,
-        price: formData.price ? parseFloat(formData.price) : null,
+        // 0 is a real price (a free item); only an empty field means "no price"
+        price: formData.price !== '' && formData.price != null ? parseFloat(formData.price) : null,
         category: useNewCategory ? newCategory : formData.category
       };
       await onSave(data);
@@ -79,8 +81,9 @@ function CatalogModal({ item, categories = [], onSave, onClose }) {
         <form onSubmit={handleSubmit}>
           <div className="modal-body">
             <div className="form-group">
-              <label className="form-label">שם הפריט *</label>
+              <label className="form-label" htmlFor={`${uid}-name`}>שם הפריט *</label>
               <input
+                id={`${uid}-name`}
                 type="text"
                 className="form-input"
                 value={formData.name}
@@ -92,8 +95,9 @@ function CatalogModal({ item, categories = [], onSave, onClose }) {
             </div>
 
             <div className="form-group">
-              <label className="form-label">תיאור</label>
+              <label className="form-label" htmlFor={`${uid}-description`}>תיאור</label>
               <textarea
+                id={`${uid}-description`}
                 className="form-input"
                 value={formData.description}
                 onChange={e => setFormData({ ...formData, description: e.target.value })}
@@ -104,8 +108,9 @@ function CatalogModal({ item, categories = [], onSave, onClose }) {
 
             <div className="form-row">
               <div className="form-group">
-                <label className="form-label">מחיר (₪)</label>
+                <label className="form-label" htmlFor={`${uid}-price`}>מחיר (₪)</label>
                 <input
+                  id={`${uid}-price`}
                   type="number"
                   className="form-input"
                   value={formData.price}
@@ -118,8 +123,9 @@ function CatalogModal({ item, categories = [], onSave, onClose }) {
               </div>
 
               <div className="form-group">
-                <label className="form-label">סוג תמחור</label>
+                <label className="form-label" htmlFor={`${uid}-pricing-type`}>סוג תמחור</label>
                 <select
+                  id={`${uid}-pricing-type`}
                   className="form-input"
                   value={formData.pricing_type}
                   onChange={e => setFormData({ ...formData, pricing_type: e.target.value })}
@@ -133,8 +139,9 @@ function CatalogModal({ item, categories = [], onSave, onClose }) {
             </div>
 
             <div className="form-group">
-              <label className="form-label">יחידת מידה (אופציונלי)</label>
+              <label className="form-label" htmlFor={`${uid}-unit`}>יחידת מידה (אופציונלי)</label>
               <input
+                id={`${uid}-unit`}
                 type="text"
                 className="form-input"
                 value={formData.unit}
@@ -145,10 +152,11 @@ function CatalogModal({ item, categories = [], onSave, onClose }) {
             </div>
 
             <div className="form-group">
-              <label className="form-label">קטגוריה</label>
+              <label className="form-label" htmlFor={`${uid}-category`}>קטגוריה</label>
               {!useNewCategory ? (
                 <div className="category-select-wrapper">
                   <select
+                    id={`${uid}-category`}
                     className="form-input"
                     value={formData.category}
                     onChange={e => setFormData({ ...formData, category: e.target.value })}
@@ -169,6 +177,7 @@ function CatalogModal({ item, categories = [], onSave, onClose }) {
               ) : (
                 <div className="category-select-wrapper">
                   <input
+                    id={`${uid}-category`}
                     type="text"
                     className="form-input"
                     value={newCategory}
@@ -188,8 +197,9 @@ function CatalogModal({ item, categories = [], onSave, onClose }) {
             </div>
 
             <div className="form-group">
-              <label className="form-label">הערות פנימיות</label>
+              <label className="form-label" htmlFor={`${uid}-notes`}>הערות פנימיות</label>
               <textarea
+                id={`${uid}-notes`}
                 className="form-input notes-input"
                 value={formData.notes}
                 onChange={e => setFormData({ ...formData, notes: e.target.value })}
diff --git a/client/src/components/ClientModal.jsx b/client/src/components/ClientModal.jsx
index 0a3c75c..a6dd4b6 100644
--- a/client/src/components/ClientModal.jsx
+++ b/client/src/components/ClientModal.jsx
@@ -1,4 +1,4 @@
-import { useState, useEffect, useRef } from 'react';
+import { useState, useEffect, useRef, useId } from 'react';
 import { createPortal } from 'react-dom';
 import { X, Plus, Trash2 } from 'lucide-react';
 import useBodyScrollLock from '../hooks/useBodyScrollLock';
@@ -8,6 +8,7 @@ import { useModal } from './Modal/ModalContext';
 
 function ClientModal({ client, onSave, onClose, onDelete }) {
   useBodyScrollLock(true);
+  const uid = useId();
   const modal = useModal();
   const formRef = useRef(null);
   const [formData, setFormData] = useState({
@@ -219,8 +220,9 @@ function ClientModal({ client, onSave, onClose, onDelete }) {
           <div className="modal-body">
             <div className="form-row">
               <div className="form-group">
-                <label className="form-label">שם לקוח *</label>
+                <label className="form-label" htmlFor={`${uid}-name`}>שם לקוח *</label>
                 <input
+                  id={`${uid}-name`}
                   type="text"
                   name="name"
                   className="form-input"
@@ -231,8 +233,9 @@ function ClientModal({ client, onSave, onClose, onDelete }) {
               </div>
 
               <div className="form-group">
-                <label className="form-label">סטטוס</label>
+                <label className="form-label" htmlFor={`${uid}-status`}>סטטוס</label>
                 <select
+                  id={`${uid}-status`}
                   name="status"
                   className="form-input"
                   defaultValue={formData.status}
@@ -248,7 +251,7 @@ function ClientModal({ client, onSave, onClose, onDelete }) {
             </div>
 
             <div className="form-group">
-              <label className="form-label">כינויים לחיפוש</label>
+              <label className="form-label" htmlFor={`${uid}-new-alias`}>כינויים לחיפוש</label>
               <div className="aliases-container">
                 {aliases.length > 0 && (
                   <div className="aliases-tags">
@@ -268,6 +271,7 @@ function ClientModal({ client, onSave, onClose, onDelete }) {
                 )}
                 <div className="alias-input-row">
                   <input
+                    id={`${uid}-new-alias`}
                     type="text"
                     className="form-input"
                     placeholder="הוסף כינוי..."
@@ -290,7 +294,7 @@ function ClientModal({ client, onSave, onClose, onDelete }) {
             </div>
 
             <div className="form-group">
-              <label className="form-label">דומיינים (לזיהוי אוטומטי)</label>
+              <label className="form-label" htmlFor={`${uid}-new-domain`}>דומיינים (לזיהוי אוטומטי)</label>
               <div className="aliases-container">
                 {domains.length > 0 && (
                   <div className="aliases-tags">
@@ -310,6 +314,7 @@ function ClientModal({ client, onSave, onClose, onDelete }) {
                 )}
                 <div className="alias-input-row">
                   <input
+                    id={`${uid}-new-domain`}
                     type="text"
                     className="form-input"
                     placeholder="zrp.co.il"
@@ -334,10 +339,11 @@ function ClientModal({ client, onSave, onClose, onDelete }) {
 
             <div className="form-row">
               <div className="form-group">
-                <label className="form-label">מקור הגעה</label>
+                <label className="form-label" htmlFor={`${uid}-source_id`}>מקור הגעה</label>
                 {!showNewSourceInput ? (
                   <div className="source-select-wrapper" style={{ display: 'flex', gap: '8px' }}>
                     <select
+                      id={`${uid}-source_id`}
                       name="source_id"
                       className="form-input"
                       value={formData.source_id}
@@ -363,6 +369,7 @@ function ClientModal({ client, onSave, onClose, onDelete }) {
                 ) : (
                   <div className="new-source-input" style={{ display: 'flex', gap: '8px' }}>
                     <input
+                      id={`${uid}-source_id`}
                       type="text"
                       className="form-input"
                       placeholder="שם המקור החדש..."
@@ -389,8 +396,9 @@ function ClientModal({ client, onSave, onClose, onDelete }) {
               </div>
 
               <div className="form-group">
-                <label className="form-label">אימייל</label>
+                <label className="form-label" htmlFor={`${uid}-email`}>אימייל</label>
                 <input
+                  id={`${uid}-email`}
                   type="email"
                   name="email"
                   className="form-input"
@@ -403,8 +411,9 @@ function ClientModal({ client, onSave, onClose, onDelete }) {
 
             {isReferralSource && (
               <div className="form-group">
-                <label className="form-label">תת מקור (מי הפנה?)</label>
+                <label className="form-label" htmlFor={`${uid}-sub_source`}>תת מקור (מי הפנה?)</label>
                 <input
+                  id={`${uid}-sub_source`}
                   type="text"
                   name="sub_source"
                   className="form-input"
@@ -417,8 +426,9 @@ function ClientModal({ client, onSave, onClose, onDelete }) {
 
             <div className="form-row">
               <div className="form-group">
-                <label className="form-label">טלפון</label>
+                <label className="form-label" htmlFor={`${uid}-phone`}>טלפון</label>
                 <input
+                  id={`${uid}-phone`}
                   type="tel"
                   name="phone"
                   className="form-input"
@@ -429,8 +439,9 @@ function ClientModal({ client, onSave, onClose, onDelete }) {
               </div>
 
               <div className="form-group">
-                <label className="form-label">ח.פ / מספר עוסק</label>
+                <label className="form-label" htmlFor={`${uid}-tax_id`}>ח.פ / מספר עוסק</label>
                 <input
+                  id={`${uid}-tax_id`}
                   type="text"
                   name="tax_id"
                   className="form-input"
@@ -442,8 +453,9 @@ function ClientModal({ client, onSave, onClose, onDelete }) {
             </div>
 
             <div className="form-group">
-              <label className="form-label">כתובת</label>
+              <label className="form-label" htmlFor={`${uid}-address`}>כתובת</label>
               <input
+                id={`${uid}-address`}
                 type="text"
                 name="address"
                 className="form-input"
@@ -456,8 +468,9 @@ function ClientModal({ client, onSave, onClose, onDelete }) {
 
             <div className="form-row form-row-3">
               <div className="form-group">
-                <label className="form-label">שם הבנק</label>
+                <label className="form-label" htmlFor={`${uid}-bank_name`}>שם הבנק</label>
                 <input
+                  id={`${uid}-bank_name`}
                   type="text"
                   name="bank_name"
                   className="form-input"
@@ -467,8 +480,9 @@ function ClientModal({ client, onSave, onClose, onDelete }) {
               </div>
 
               <div className="form-group">
-                <label className="form-label">סניף</label>
+                <label className="form-label" htmlFor={`${uid}-bank_branch`}>סניף</label>
                 <input
+                  id={`${uid}-bank_branch`}
                   type="text"
                   name="bank_branch"
                   className="form-input"
@@ -479,8 +493,9 @@ function ClientModal({ client, onSave, onClose, onDelete }) {
               </div>
 
               <div className="form-group">
-                <label className="form-label">מספר חשבון</label>
+                <label className="form-label" htmlFor={`${uid}-bank_account`}>מספר חשבון</label>
                 <input
+                  id={`${uid}-bank_account`}
                   type="text"
                   name="bank_account"
                   className="form-input"
@@ -492,8 +507,9 @@ function ClientModal({ client, onSave, onClose, onDelete }) {
             </div>
 
             <div className="form-group">
-              <label className="form-label">מחיר לשעה (₪)</label>
+              <label className="form-label" htmlFor={`${uid}-hourly_rate`}>מחיר לשעה (₪)</label>
               <input
+                id={`${uid}-hourly_rate`}
                 type="number"
                 name="hourly_rate"
                 className="form-input"
@@ -507,8 +523,9 @@ function ClientModal({ client, onSave, onClose, onDelete }) {
             </div>
 
             <div className="form-group">
-              <label className="form-label">📝 פתק פרטי (לעצמך)</label>
+              <label className="form-label" htmlFor={`${uid}-notes`}>📝 פתק פרטי (לעצמך)</label>
               <textarea
+                id={`${uid}-notes`}
                 name="notes"
                 className="form-input notes-input"
                 defaultValue={formData.notes}
diff --git a/client/src/components/ClientModal.test.jsx b/client/src/components/ClientModal.test.jsx
new file mode 100644
index 0000000..b1da65f
--- /dev/null
+++ b/client/src/components/ClientModal.test.jsx
@@ -0,0 +1,95 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+
+const apiMocks = vi.hoisted(() => ({
+  clientSourcesAPI: { getAll: vi.fn(), create: vi.fn() },
+  clientsAPI: { delete: vi.fn() }
+}));
+
+vi.mock('../services/api', () => apiMocks);
+
+import ClientModal from './ClientModal';
+import { ModalProvider } from './Modal';
+
+const { clientSourcesAPI } = apiMocks;
+const sources = [
+  { id: 's1', name: 'הפניות' },
+  { id: 's2', name: 'גוגל' }
+];
+
+beforeEach(() => {
+  Object.values(apiMocks).forEach(group => Object.values(group).forEach(fn => fn.mockReset()));
+  clientSourcesAPI.getAll.mockResolvedValue(sources);
+});
+
+// Waits for the sources list to load so the async state update happens inside the test
+const renderModal = async (props = {}) => {
+  const user = userEvent.setup();
+  render(
+    <ModalProvider>
+      <ClientModal onSave={vi.fn()} onClose={vi.fn()} {...props} />
+    </ModalProvider>
+  );
+  await screen.findByRole('option', { name: 'גוגל' });
+  return user;
+};
+
+describe('ClientModal - labelled fields', () => {
+  it('exposes the form fields through their labels', async () => {
+    await renderModal();
+
+    const name = screen.getByLabelText('שם לקוח *');
+    expect(name.tagName).toBe('INPUT');
+    expect(name).toHaveAttribute('name', 'name');
+    expect(name).toBeRequired();
+
+    const status = screen.getByLabelText('סטטוס');
+    expect(status.tagName).toBe('SELECT');
+    expect(status).toHaveAttribute('name', 'status');
+
+    expect(screen.getByLabelText('אימייל')).toHaveAttribute('type', 'email');
+    expect(screen.getByLabelText('טלפון')).toHaveAttribute('type', 'tel');
+    expect(screen.getByLabelText('ח.פ / מספר עוסק')).toHaveAttribute('name', 'tax_id');
+    expect(screen.getByLabelText('כתובת')).toHaveAttribute('name', 'address');
+    expect(screen.getByLabelText('שם הבנק')).toHaveAttribute('name', 'bank_name');
+    expect(screen.getByLabelText('סניף')).toHaveAttribute('name', 'bank_branch');
+    expect(screen.getByLabelText('מספר חשבון')).toHaveAttribute('name', 'bank_account');
+    expect(screen.getByLabelText('מחיר לשעה (₪)')).toHaveAttribute('name', 'hourly_rate');
+    expect(screen.getByLabelText('📝 פתק פרטי (לעצמך)').tagName).toBe('TEXTAREA');
+    expect(screen.getByLabelText('מקור הגעה')).toHaveAttribute('name', 'source_id');
+    expect(screen.getByLabelText('כינויים לחיפוש')).toHaveAttribute('placeholder', 'הוסף כינוי...');
+    expect(screen.getByLabelText('דומיינים (לזיהוי אוטומטי)')).toHaveAttribute('placeholder', 'zrp.co.il');
+  });
+
+  it('accepts typing into a field found by its label', async () => {
+    const user = await renderModal();
+
+    const email = screen.getByLabelText('אימייל');
+    await user.type(email, 'dana@example.com');
+    expect(email).toHaveValue('dana@example.com');
+
+    await user.type(screen.getByLabelText('כינויים לחיפוש'), 'דנה{Enter}');
+    expect(screen.getByText('דנה')).toHaveClass('alias-tag');
+    expect(screen.getByLabelText('כינויים לחיפוש')).toHaveValue('');
+  });
+
+  it('keeps the source label on whichever source control is shown', async () => {
+    const user = await renderModal();
+
+    await user.click(screen.getByRole('button', { name: 'הוסף מקור חדש' }));
+
+    const newSource = screen.getByLabelText('מקור הגעה');
+    expect(newSource.tagName).toBe('INPUT');
+    expect(newSource).toHaveAttribute('placeholder', 'שם המקור החדש...');
+  });
+
+  it('labels the referral field when the referrals source is picked', async () => {
+    const user = await renderModal();
+    expect(screen.queryByLabelText('תת מקור (מי הפנה?)')).not.toBeInTheDocument();
+
+    await user.selectOptions(screen.getByLabelText('מקור הגעה'), 's1');
+
+    expect(screen.getByLabelText('תת מקור (מי הפנה?)')).toHaveAttribute('name', 'sub_source');
+  });
+});
diff --git a/client/src/components/Credentials.jsx b/client/src/components/Credentials.jsx
index 9d2114e..7311d68 100644
--- a/client/src/components/Credentials.jsx
+++ b/client/src/components/Credentials.jsx
@@ -1,8 +1,9 @@
-import { useState, useEffect } from 'react';
+import { useState, useEffect, useId } from 'react';
 import { createPortal } from 'react-dom';
 import { Key, Eye, EyeOff, Copy, ExternalLink, Plus, Edit2, Trash2 } from 'lucide-react';
 
 function CredentialModal({ isOpen, onClose, onSave, credential, clientId, projectId }) {
+    const uid = useId();
     const [formData, setFormData] = useState({
         service_name: '',
         username: '',
@@ -63,8 +64,9 @@ function CredentialModal({ isOpen, onClose, onSave, credential, clientId, projec
 
                 <form onSubmit={handleSubmit} className="modal-content">
                     <div className="form-group">
-                        <label>שם השירות *</label>
+                        <label htmlFor={`${uid}-service-name`}>שם השירות *</label>
                         <input
+                            id={`${uid}-service-name`}
                             type="text"
                             value={formData.service_name}
                             onChange={e => setFormData({ ...formData, service_name: e.target.value })}
@@ -75,8 +77,9 @@ function CredentialModal({ isOpen, onClose, onSave, credential, clientId, projec
                     </div>
 
                     <div className="form-group">
-                        <label>שם משתמש / אימייל</label>
+                        <label htmlFor={`${uid}-username`}>שם משתמש / אימייל</label>
                         <input
+                            id={`${uid}-username`}
                             type="text"
                             value={formData.username}
                             onChange={e => setFormData({ ...formData, username: e.target.value })}
@@ -85,9 +88,10 @@ function CredentialModal({ isOpen, onClose, onSave, credential, clientId, projec
                     </div>
 
                     <div className="form-group">
-                        <label>סיסמה</label>
+                        <label htmlFor={`${uid}-password`}>סיסמה</label>
                         <div className="password-input-wrapper">
                             <input
+                                id={`${uid}-password`}
                                 type={showPassword ? 'text' : 'password'}
                                 value={formData.password}
                                 onChange={e => setFormData({ ...formData, password: e.target.value })}
@@ -104,8 +108,9 @@ function CredentialModal({ isOpen, onClose, onSave, credential, clientId, projec
                     </div>
 
                     <div className="form-group">
-                        <label>כתובת URL</label>
+                        <label htmlFor={`${uid}-url`}>כתובת URL</label>
                         <input
+                            id={`${uid}-url`}
                             type="url"
                             value={formData.url}
                             onChange={e => setFormData({ ...formData, url: e.target.value })}
@@ -115,8 +120,9 @@ function CredentialModal({ isOpen, onClose, onSave, credential, clientId, projec
                     </div>
 
                     <div className="form-group">
-                        <label>הערות</label>
+                        <label htmlFor={`${uid}-notes`}>הערות</label>
                         <textarea
+                            id={`${uid}-notes`}
                             value={formData.notes}
                             onChange={e => setFormData({ ...formData, notes: e.target.value })}
                             placeholder="הערות נוספות..."
diff --git a/client/src/components/Layout.jsx b/client/src/components/Layout.jsx
index 62afbdb..3371cf8 100644
--- a/client/src/components/Layout.jsx
+++ b/client/src/components/Layout.jsx
@@ -8,6 +8,7 @@ import StatsBar from './StatsBar';
 import WorkspaceSwitcher from './WorkspaceSwitcher';
 import GlobalSearch from './GlobalSearch';
 import AIAssistant from './AIAssistant';
+import RouteSuspense from './RouteSuspense';
 import './Layout.css';
 
 const MIN_SIDEBAR_WIDTH = 180;
@@ -453,7 +454,10 @@ function Layout() {
         )}
 
         <div className="container content-container">
+          {/* Lazy pages load inside this boundary, so the sidebar and header stay while they do */}
+          <RouteSuspense>
           <Outlet context={{ setStats: setCurrentStats, selectedMonth, setSelectedMonth, dateRange, setDateRange }} />
+          </RouteSuspense>
         </div>
       </main>
 
diff --git a/client/src/components/LeadConvertModal.jsx b/client/src/components/LeadConvertModal.jsx
index b4ae96b..cd1feaa 100644
--- a/client/src/components/LeadConvertModal.jsx
+++ b/client/src/components/LeadConvertModal.jsx
@@ -1,4 +1,4 @@
-import { useState } from 'react';
+import { useState, useId } from 'react';
 import { X, ArrowLeft, CheckCircle, Folder, Clock, ListTodo, Bell, Building2 } from 'lucide-react';
 import { leadsAPI } from '../services/api';
 import { useModal } from './Modal';
@@ -8,6 +8,7 @@ import { formatDurationHuman } from '../utils/format';
 function LeadConvertModal({ isOpen, onClose, lead, onConverted }) {
   const modal = useModal();
   const navigate = useNavigate();
+  const uid = useId();
   const [loading, setLoading] = useState(false);
   const [result, setResult] = useState(null);
   const [form, setForm] = useState({
@@ -175,8 +176,9 @@ function LeadConvertModal({ isOpen, onClose, lead, onConverted }) {
 
                   {/* Project name */}
                   <div className="form-group" style={{ marginBottom: '0.75rem' }}>
-                    <label className="form-label">שם הפרויקט</label>
+                    <label className="form-label" htmlFor={`${uid}-project-name`}>שם הפרויקט</label>
                     <input
+                      id={`${uid}-project-name`}
                       type="text"
                       className="form-input"
                       value={acquisitionProjectName}
@@ -207,8 +209,9 @@ function LeadConvertModal({ isOpen, onClose, lead, onConverted }) {
 
                   <div className="form-grid">
                     <div className="form-group">
-                      <label className="form-label">שם הלקוח</label>
+                      <label className="form-label" htmlFor={`${uid}-override-name`}>שם הלקוח</label>
                       <input
+                        id={`${uid}-override-name`}
                         type="text"
                         className="form-input"
                         value={form.override_name}
@@ -217,8 +220,9 @@ function LeadConvertModal({ isOpen, onClose, lead, onConverted }) {
                       />
                     </div>
                     <div className="form-group">
-                      <label className="form-label">אימייל</label>
+                      <label className="form-label" htmlFor={`${uid}-override-email`}>אימייל</label>
                       <input
+                        id={`${uid}-override-email`}
                         type="email"
                         className="form-input"
                         value={form.override_email}
@@ -227,8 +231,9 @@ function LeadConvertModal({ isOpen, onClose, lead, onConverted }) {
                       />
                     </div>
                     <div className="form-group">
-                      <label className="form-label">טלפון</label>
+                      <label className="form-label" htmlFor={`${uid}-override-phone`}>טלפון</label>
                       <input
+                        id={`${uid}-override-phone`}
                         type="tel"
                         className="form-input"
                         value={form.override_phone}
@@ -237,8 +242,9 @@ function LeadConvertModal({ isOpen, onClose, lead, onConverted }) {
                       />
                     </div>
                     <div className="form-group">
-                      <label className="form-label">כתובת (מחברה)</label>
+                      <label className="form-label" htmlFor={`${uid}-override-company`}>כתובת (מחברה)</label>
                       <input
+                        id={`${uid}-override-company`}
                         type="text"
                         className="form-input"
                         value={form.override_company}
@@ -268,8 +274,9 @@ function LeadConvertModal({ isOpen, onClose, lead, onConverted }) {
                     {createAcquisitionProject && (
                       <div style={{ marginTop: '0.75rem', paddingRight: '1.75rem' }}>
                         <div className="form-group" style={{ marginBottom: '0.5rem' }}>
-                          <label className="form-label" style={{ fontSize: '0.8rem' }}>שם הפרויקט</label>
+                          <label className="form-label" style={{ fontSize: '0.8rem' }} htmlFor={`${uid}-project-name`}>שם הפרויקט</label>
                           <input
+                            id={`${uid}-project-name`}
                             type="text"
                             className="form-input"
                             value={acquisitionProjectName}
diff --git a/client/src/components/LeadModal.jsx b/client/src/components/LeadModal.jsx
index 8f9ff8f..8caa454 100644
--- a/client/src/components/LeadModal.jsx
+++ b/client/src/components/LeadModal.jsx
@@ -1,4 +1,4 @@
-import { useState, useEffect } from 'react';
+import { useState, useEffect, useId } from 'react';
 import { X, Building2 } from 'lucide-react';
 import { leadsAPI, clientSourcesAPI, clientsAPI } from '../services/api';
 import { useModal } from './Modal';
@@ -6,6 +6,7 @@ import { LEAD_STATUSES, LEAD_PRIORITIES, LEAD_SOURCE_TYPES } from '../utils/lead
 
 function LeadModal({ isOpen, onClose, lead = null, onSaved, workspaceMembers = [], initialClientId = null }) {
   const modal = useModal();
+  const uid = useId();
   const [loading, setLoading] = useState(false);
   const [sources, setSources] = useState([]);
   const [clients, setClients] = useState([]);
@@ -155,8 +156,9 @@ function LeadModal({ isOpen, onClose, lead = null, onSaved, workspaceMembers = [
 
           {isOpportunity && (
             <div className="form-group" style={{ marginBottom: '0.75rem' }}>
-              <label className="form-label">לקוח מקושר *</label>
+              <label className="form-label" htmlFor={`${uid}-client-id`}>לקוח מקושר *</label>
               <select
+                id={`${uid}-client-id`}
                 className="form-input"
                 value={form.client_id}
                 onChange={(e) => setForm({ ...form, client_id: e.target.value })}
@@ -171,8 +173,9 @@ function LeadModal({ isOpen, onClose, lead = null, onSaved, workspaceMembers = [
 
           <div className="form-grid">
             <div className="form-group">
-              <label className="form-label">שם *</label>
+              <label className="form-label" htmlFor={`${uid}-name`}>שם *</label>
               <input
+                id={`${uid}-name`}
                 type="text"
                 className="form-input"
                 value={form.name}
@@ -183,8 +186,9 @@ function LeadModal({ isOpen, onClose, lead = null, onSaved, workspaceMembers = [
             </div>
 
             <div className="form-group">
-              <label className="form-label">חברה</label>
+              <label className="form-label" htmlFor={`${uid}-company`}>חברה</label>
               <input
+                id={`${uid}-company`}
                 type="text"
                 className="form-input"
                 value={form.company}
@@ -194,8 +198,9 @@ function LeadModal({ isOpen, onClose, lead = null, onSaved, workspaceMembers = [
             </div>
 
             <div className="form-group">
-              <label className="form-label">אימייל</label>
+              <label className="form-label" htmlFor={`${uid}-email`}>אימייל</label>
               <input
+                id={`${uid}-email`}
                 type="email"
                 className="form-input"
                 value={form.email}
@@ -205,8 +210,9 @@ function LeadModal({ isOpen, onClose, lead = null, onSaved, workspaceMembers = [
             </div>
 
             <div className="form-group">
-              <label className="form-label">טלפון</label>
+              <label className="form-label" htmlFor={`${uid}-phone`}>טלפון</label>
               <input
+                id={`${uid}-phone`}
                 type="tel"
                 className="form-input"
                 value={form.phone}
@@ -216,8 +222,9 @@ function LeadModal({ isOpen, onClose, lead = null, onSaved, workspaceMembers = [
             </div>
 
             <div className="form-group">
-              <label className="form-label">סטטוס</label>
+              <label className="form-label" htmlFor={`${uid}-status`}>סטטוס</label>
               <select
+                id={`${uid}-status`}
                 className="form-input"
                 value={form.status}
                 onChange={(e) => setForm({ ...form, status: e.target.value })}
@@ -229,8 +236,9 @@ function LeadModal({ isOpen, onClose, lead = null, onSaved, workspaceMembers = [
             </div>
 
             <div className="form-group">
-              <label className="form-label">עדיפות</label>
+              <label className="form-label" htmlFor={`${uid}-priority`}>עדיפות</label>
               <select
+                id={`${uid}-priority`}
                 className="form-input"
                 value={form.priority}
                 onChange={(e) => setForm({ ...form, priority: e.target.value })}
@@ -242,8 +250,9 @@ function LeadModal({ isOpen, onClose, lead = null, onSaved, workspaceMembers = [
             </div>
 
             <div className="form-group">
-              <label className="form-label">סוג מקור</label>
+              <label className="form-label" htmlFor={`${uid}-source-type`}>סוג מקור</label>
               <select
+                id={`${uid}-source-type`}
                 className="form-input"
                 value={form.source_type}
                 onChange={(e) => setForm({ ...form, source_type: e.target.value })}
@@ -255,8 +264,9 @@ function LeadModal({ isOpen, onClose, lead = null, onSaved, workspaceMembers = [
             </div>
 
             <div className="form-group">
-              <label className="form-label">מקור (קטגוריה)</label>
+              <label className="form-label" htmlFor={`${uid}-source-id`}>מקור (קטגוריה)</label>
               <select
+                id={`${uid}-source-id`}
                 className="form-input"
                 value={form.source_id}
                 onChange={(e) => setForm({ ...form, source_id: e.target.value })}
@@ -269,8 +279,9 @@ function LeadModal({ isOpen, onClose, lead = null, onSaved, workspaceMembers = [
             </div>
 
             <div className="form-group">
-              <label className="form-label">פרטי מקור</label>
+              <label className="form-label" htmlFor={`${uid}-source-detail`}>פרטי מקור</label>
               <input
+                id={`${uid}-source-detail`}
                 type="text"
                 className="form-input"
                 value={form.source_detail}
@@ -280,8 +291,9 @@ function LeadModal({ isOpen, onClose, lead = null, onSaved, workspaceMembers = [
             </div>
 
             <div className="form-group">
-              <label className="form-label">ערך צפוי (₪)</label>
+              <label className="form-label" htmlFor={`${uid}-expected-value`}>ערך צפוי (₪)</label>
               <input
+                id={`${uid}-expected-value`}
                 type="number"
                 className="form-input"
                 value={form.expected_value}
@@ -291,8 +303,9 @@ function LeadModal({ isOpen, onClose, lead = null, onSaved, workspaceMembers = [
             </div>
 
             <div className="form-group">
-              <label className="form-label">תאריך סגירה צפוי</label>
+              <label className="form-label" htmlFor={`${uid}-expected-close-date`}>תאריך סגירה צפוי</label>
               <input
+                id={`${uid}-expected-close-date`}
                 type="date"
                 className="form-input"
                 value={form.expected_close_date}
@@ -301,8 +314,9 @@ function LeadModal({ isOpen, onClose, lead = null, onSaved, workspaceMembers = [
             </div>
 
             <div className="form-group">
-              <label className="form-label">אחראי</label>
+              <label className="form-label" htmlFor={`${uid}-assigned-to`}>אחראי</label>
               <select
+                id={`${uid}-assigned-to`}
                 className="form-input"
                 value={form.assigned_to}
                 onChange={(e) => setForm({ ...form, assigned_to: e.target.value })}
@@ -316,8 +330,9 @@ function LeadModal({ isOpen, onClose, lead = null, onSaved, workspaceMembers = [
           </div>
 
           <div className="form-group" style={{ marginTop: '0.75rem' }}>
-            <label className="form-label">תגיות (מופרדות בפסיק)</label>
+            <label className="form-label" htmlFor={`${uid}-tags`}>תגיות (מופרדות בפסיק)</label>
             <input
+              id={`${uid}-tags`}
               type="text"
               className="form-input"
               value={form.tags}
@@ -327,8 +342,9 @@ function LeadModal({ isOpen, onClose, lead = null, onSaved, workspaceMembers = [
           </div>
 
           <div className="form-group" style={{ marginTop: '0.75rem' }}>
-            <label className="form-label">הערות</label>
+            <label className="form-label" htmlFor={`${uid}-notes`}>הערות</label>
             <textarea
+              id={`${uid}-notes`}
               className="form-input"
               value={form.notes}
               onChange={(e) => setForm({ ...form, notes: e.target.value })}
diff --git a/client/src/components/Modal/CustomModal.jsx b/client/src/components/Modal/CustomModal.jsx
index 6fd8c64..743ac72 100644
--- a/client/src/components/Modal/CustomModal.jsx
+++ b/client/src/components/Modal/CustomModal.jsx
@@ -1,4 +1,4 @@
-import { useEffect, useRef, useState } from 'react';
+import { useEffect, useId, useRef, useState } from 'react';
 import { createPortal } from 'react-dom';
 import useBodyScrollLock from '../../hooks/useBodyScrollLock';
 import './CustomModal.css';
@@ -22,9 +22,12 @@ function CustomModal({
   isPrompt = false,
   promptValue = '',
   placeholder = '',
+  inputType = 'text',
+  autoComplete,
   onConfirm,
   onCancel
 }) {
+  const messageId = useId();
   const confirmBtnRef = useRef(null);
   const inputRef = useRef(null);
   const [inputValue, setInputValue] = useState('');
@@ -83,12 +86,14 @@ function CustomModal({
         
         <h3 className="custom-modal__title">{title}</h3>
         
-        <p className="custom-modal__message">{message}</p>
+        <p className="custom-modal__message" id={messageId}>{message}</p>
         
         {isPrompt && (
           <input
             ref={inputRef}
-            type="text"
+            type={inputType}
+            autoComplete={autoComplete}
+            aria-labelledby={messageId}
             className="custom-modal__input"
             placeholder={placeholder}
             value={inputValue}
diff --git a/client/src/components/Modal/ModalContext.jsx b/client/src/components/Modal/ModalContext.jsx
index 4a4a12b..3606c40 100644
--- a/client/src/components/Modal/ModalContext.jsx
+++ b/client/src/components/Modal/ModalContext.jsx
@@ -24,7 +24,9 @@ export function ModalProvider({ children }) {
     showCancel: false,
     isPrompt: false,
     promptValue: '',
-    placeholder: ''
+    placeholder: '',
+    inputType: 'text',
+    autoComplete: undefined
   });
 
   const closeModal = useCallback(() => {
@@ -90,12 +92,17 @@ export function ModalProvider({ children }) {
     });
   }, [closeModal]);
 
-  // Prompt - asks for text input
+  // Prompt - asks for text input.
+  // options.type is the modal style (like the other dialogs); options.inputType is the <input> type -
+  // pass inputType: 'password' to mask what is typed. 'password' is not a modal style, so the older
+  // { type: 'password' } spelling is read as inputType: 'password' with the default style.
   const prompt = useCallback((message, options = {}) => {
+    const legacyPasswordType = options.type === 'password';
+    const inputType = options.inputType || (legacyPasswordType ? 'password' : 'text');
     return new Promise((resolve) => {
       setModalState({
         isOpen: true,
-        type: options.type || 'info',
+        type: (!legacyPasswordType && options.type) || 'info',
         title: options.title || 'הזן ערך',
         message,
         confirmText: options.confirmText || 'אישור',
@@ -104,6 +111,8 @@ export function ModalProvider({ children }) {
         isPrompt: true,
         promptValue: '',
         placeholder: options.placeholder || '',
+        inputType,
+        autoComplete: options.autoComplete || (inputType === 'password' ? 'new-password' : undefined),
         onConfirm: (value) => {
           closeModal();
           resolve(value);
@@ -141,6 +150,8 @@ export function ModalProvider({ children }) {
         isPrompt={modalState.isPrompt}
         promptValue={modalState.promptValue}
         placeholder={modalState.placeholder}
+        inputType={modalState.inputType}
+        autoComplete={modalState.autoComplete}
         onConfirm={modalState.onConfirm}
         onCancel={modalState.onCancel}
       />
diff --git a/client/src/components/Modal/ModalContext.test.jsx b/client/src/components/Modal/ModalContext.test.jsx
new file mode 100644
index 0000000..0481807
--- /dev/null
+++ b/client/src/components/Modal/ModalContext.test.jsx
@@ -0,0 +1,72 @@
+import { describe, it, expect } from 'vitest';
+import { render, screen, act } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { ModalProvider, useModal } from './index';
+
+let modal;
+function Grab() {
+  modal = useModal();
+  return null;
+}
+
+const renderProvider = () => {
+  render(<ModalProvider><Grab /></ModalProvider>);
+  return userEvent.setup();
+};
+
+const openPrompt = (options) => {
+  let result;
+  act(() => { result = modal.prompt('הזן ערך:', options); });
+  return result;
+};
+
+describe('modal.prompt input type', () => {
+  it('is a labelled plain text field by default', () => {
+    renderProvider();
+    openPrompt({ placeholder: 'שם' });
+
+    const input = screen.getByLabelText('הזן ערך:');
+    expect(input).toHaveAttribute('type', 'text');
+    expect(input).not.toHaveAttribute('autocomplete');
+    expect(document.querySelector('.custom-modal')).toHaveClass('custom-modal--info');
+  });
+
+  it('masks the value with inputType: "password" and resolves with what was typed', async () => {
+    const user = renderProvider();
+    const result = openPrompt({ inputType: 'password', placeholder: 'סיסמה חדשה' });
+
+    const input = screen.getByLabelText('הזן ערך:');
+    expect(input).toHaveAttribute('type', 'password');
+    expect(input).toHaveAttribute('autocomplete', 'new-password');
+
+    await user.type(input, 'secret');
+    await user.click(screen.getByRole('button', { name: 'אישור' }));
+    await expect(result).resolves.toBe('secret');
+  });
+
+  it('reads the older { type: "password" } as a masked field with the default style', () => {
+    renderProvider();
+    openPrompt({ type: 'password' });
+
+    expect(screen.getByLabelText('הזן ערך:')).toHaveAttribute('type', 'password');
+    expect(document.querySelector('.custom-modal')).toHaveClass('custom-modal--info');
+    expect(document.querySelector('.custom-modal__icon')).toHaveTextContent('💬');
+  });
+
+  it('keeps type as the modal style for other values', () => {
+    renderProvider();
+    openPrompt({ type: 'warning' });
+
+    expect(screen.getByLabelText('הזן ערך:')).toHaveAttribute('type', 'text');
+    expect(document.querySelector('.custom-modal')).toHaveClass('custom-modal--warning');
+  });
+
+  it('a later prompt without inputType is a text field again', async () => {
+    const user = renderProvider();
+    openPrompt({ inputType: 'password' });
+    await user.click(screen.getByRole('button', { name: 'ביטול' }));
+
+    openPrompt();
+    expect(screen.getByLabelText('הזן ערך:')).toHaveAttribute('type', 'text');
+  });
+});
diff --git a/client/src/components/PaymentModal.jsx b/client/src/components/PaymentModal.jsx
index 03cbb2c..c9bb55d 100644
--- a/client/src/components/PaymentModal.jsx
+++ b/client/src/components/PaymentModal.jsx
@@ -1,4 +1,4 @@
-import { useState, useEffect } from 'react';
+import { useState, useEffect, useId } from 'react';
 import { createPortal } from 'react-dom';
 import { DollarSign, Calendar, FileText, CreditCard, Clock, Tag, Link2, Plus, X } from 'lucide-react';
 import { projectsAPI, tasksAPI } from '../services/api';
@@ -25,6 +25,7 @@ const PAYMENT_METHODS = [
 
 function PaymentModal({ payment, projectId, projects, tasks, onSave, onClose }) {
     useBodyScrollLock(true);
+    const uid = useId();
 
     const [formData, setFormData] = useState({
         amount: '',
@@ -167,11 +168,12 @@ function PaymentModal({ payment, projectId, projects, tasks, onSave, onClose })
                     <div className="modal-body">
                         {showProjectSelect && (
                             <div className="form-group">
-                                <label className="form-label">
+                                <label className="form-label" htmlFor={`${uid}-project_id`}>
                                     <Tag size={16} style={{ marginLeft: '0.25rem' }} />
                                     פרויקט
                                 </label>
                                 <select
+                                    id={`${uid}-project_id`}
                                     name="project_id"
                                     className="form-input"
                                     value={formData.project_id}
@@ -189,8 +191,9 @@ function PaymentModal({ payment, projectId, projects, tasks, onSave, onClose })
 
                         {formData.project_id && projectTasks.length > 0 && (
                             <div className="form-group">
-                                <label className="form-label">משימה (אופציונלי)</label>
+                                <label className="form-label" htmlFor={`${uid}-task_id`}>משימה (אופציונלי)</label>
                                 <select
+                                    id={`${uid}-task_id`}
                                     name="task_id"
                                     className="form-input"
                                     value={formData.task_id}
@@ -208,12 +211,13 @@ function PaymentModal({ payment, projectId, projects, tasks, onSave, onClose })
 
                         <div className="form-row" style={{ display: 'grid', gridTemplateColumns: '1fr 1fr', gap: '1rem' }}>
                             <div className="form-group">
-                                <label className="form-label">
+                                <label className="form-label" htmlFor={`${uid}-amount`}>
                                     <DollarSign size={16} style={{ marginLeft: '0.25rem' }} />
                                     סכום
                                 </label>
                                 <input
                                     type="number"
+                                    id={`${uid}-amount`}
                                     name="amount"
                                     className="form-input"
                                     value={formData.amount}
@@ -227,11 +231,12 @@ function PaymentModal({ payment, projectId, projects, tasks, onSave, onClose })
                             </div>
 
                             <div className="form-group">
-                                <label className="form-label">
+                                <label className="form-label" htmlFor={`${uid}-status`}>
                                     <Clock size={16} style={{ marginLeft: '0.25rem' }} />
                                     סטטוס
                                 </label>
                                 <select
+                                    id={`${uid}-status`}
                                     name="status"
                                     className="form-input"
                                     value={formData.status}
@@ -246,12 +251,13 @@ function PaymentModal({ payment, projectId, projects, tasks, onSave, onClose })
 
                         <div className="form-row" style={{ display: 'grid', gridTemplateColumns: '1fr 1fr', gap: '1rem' }}>
                             <div className="form-group">
-                                <label className="form-label">
+                                <label className="form-label" htmlFor={`${uid}-date`}>
                                     <Calendar size={16} style={{ marginLeft: '0.25rem' }} />
                                     תאריך תשלום
                                 </label>
                                 <input
                                     type="date"
+                                    id={`${uid}-date`}
                                     name="date"
                                     className="form-input"
                                     value={formData.date}
@@ -262,12 +268,13 @@ function PaymentModal({ payment, projectId, projects, tasks, onSave, onClose })
                             </div>
 
                             <div className="form-group">
-                                <label className="form-label">
+                                <label className="form-label" htmlFor={`${uid}-due_date`}>
                                     <Calendar size={16} style={{ marginLeft: '0.25rem' }} />
                                     תאריך יעד
                                 </label>
                                 <input
                                     type="date"
+                                    id={`${uid}-due_date`}
                                     name="due_date"
                                     className="form-input"
                                     value={formData.due_date}
@@ -278,11 +285,12 @@ function PaymentModal({ payment, projectId, projects, tasks, onSave, onClose })
                         </div>
 
                         <div className="form-group">
-                            <label className="form-label">
+                            <label className="form-label" htmlFor={`${uid}-payment_method`}>
                                 <CreditCard size={16} style={{ marginLeft: '0.25rem' }} />
                                 אמצעי תשלום
                             </label>
                             <select
+                                id={`${uid}-payment_method`}
                                 name="payment_method"
                                 className="form-input"
                                 value={formData.payment_method}
@@ -295,11 +303,12 @@ function PaymentModal({ payment, projectId, projects, tasks, onSave, onClose })
                         </div>
 
                         <div className="form-group">
-                            <label className="form-label">
+                            <label className="form-label" htmlFor={`${uid}-notes`}>
                                 <FileText size={16} style={{ marginLeft: '0.25rem' }} />
                                 הערות
                             </label>
                             <textarea
+                                id={`${uid}-notes`}
                                 name="notes"
                                 className="form-input"
                                 value={formData.notes}
diff --git a/client/src/components/ProjectModal.jsx b/client/src/components/ProjectModal.jsx
index 2abcefe..dce4b82 100644
--- a/client/src/components/ProjectModal.jsx
+++ b/client/src/components/ProjectModal.jsx
@@ -1,4 +1,4 @@
-import { useState, useEffect, useRef } from 'react';
+import { useState, useEffect, useRef, useId } from 'react';
 import { createPortal } from 'react-dom';
 import { X } from 'lucide-react';
 import useBodyScrollLock from '../hooks/useBodyScrollLock';
@@ -6,6 +6,7 @@ import { clientsAPI } from '../services/api';
 
 function ProjectModal({ project, clientHourlyRate, onSave, onClose, clientId = null }) {
   useBodyScrollLock(true);
+  const uid = useId();
   const formRef = useRef(null);
   const [formData, setFormData] = useState({
     name: '',
@@ -123,8 +124,9 @@ function ProjectModal({ project, clientHourlyRate, onSave, onClose, clientId = n
         <form ref={formRef} onSubmit={handleSubmit}>
           <div className="modal-body">
             <div className="form-group">
-              <label className="form-label">שם הפרויקט *</label>
+              <label className="form-label" htmlFor={`${uid}-name`}>שם הפרויקט *</label>
               <input
+                id={`${uid}-name`}
                 type="text"
                 name="name"
                 className="form-input"
@@ -135,8 +137,9 @@ function ProjectModal({ project, clientHourlyRate, onSave, onClose, clientId = n
             </div>
 
             <div className="form-group">
-              <label className="form-label">לקוח *</label>
+              <label className="form-label" htmlFor={`${uid}-client_id`}>לקוח *</label>
               <select
+                id={`${uid}-client_id`}
                 name="client_id"
                 className="form-input"
                 value={formData.client_id}
@@ -152,8 +155,9 @@ function ProjectModal({ project, clientHourlyRate, onSave, onClose, clientId = n
             </div>
             
             <div className="form-group">
-              <label className="form-label">תיאור</label>
+              <label className="form-label" htmlFor={`${uid}-description`}>תיאור</label>
               <textarea
+                id={`${uid}-description`}
                 name="description"
                 className="form-input"
                 value={formData.description}
@@ -163,8 +167,9 @@ function ProjectModal({ project, clientHourlyRate, onSave, onClose, clientId = n
             </div>
             
             <div className="form-group">
-              <label className="form-label">סוג תמחור</label>
+              <label className="form-label" htmlFor={`${uid}-pricing_type`}>סוג תמחור</label>
               <select
+                id={`${uid}-pricing_type`}
                 name="pricing_type"
                 className="form-input"
                 value={formData.pricing_type}
@@ -178,8 +183,9 @@ function ProjectModal({ project, clientHourlyRate, onSave, onClose, clientId = n
             
             {pricingType === 'fixed' ? (
               <div className="form-group">
-                <label className="form-label">מחיר קבוע (₪)</label>
+                <label className="form-label" htmlFor={`${uid}-fixed_price`}>מחיר קבוע (₪)</label>
                 <input
+                  id={`${uid}-fixed_price`}
                   type="number"
                   name="fixed_price"
                   className="form-input"
@@ -192,8 +198,9 @@ function ProjectModal({ project, clientHourlyRate, onSave, onClose, clientId = n
               </div>
             ) : pricingType === 'hourly' ? (
               <div className="form-group">
-                <label className="form-label">מחיר לשעה (₪)</label>
+                <label className="form-label" htmlFor={`${uid}-hourly_rate`}>מחיר לשעה (₪)</label>
                 <input
+                  id={`${uid}-hourly_rate`}
                   type="number"
                   name="hourly_rate"
                   className="form-input"
@@ -208,8 +215,9 @@ function ProjectModal({ project, clientHourlyRate, onSave, onClose, clientId = n
             ) : null}
             
             <div className="form-group">
-              <label className="form-label">סטטוס</label>
+              <label className="form-label" htmlFor={`${uid}-status`}>סטטוס</label>
               <select
+                id={`${uid}-status`}
                 name="status"
                 className="form-input"
                 value={formData.status}
@@ -226,8 +234,9 @@ function ProjectModal({ project, clientHourlyRate, onSave, onClose, clientId = n
             </div>
             
             <div className="form-group">
-              <label className="form-label">🎯 חשיבות</label>
+              <label className="form-label" htmlFor={`${uid}-priority`}>🎯 חשיבות</label>
               <select
+                id={`${uid}-priority`}
                 name="priority"
                 className="form-input"
                 value={formData.priority}
@@ -240,8 +249,8 @@ function ProjectModal({ project, clientHourlyRate, onSave, onClose, clientId = n
             </div>
             
             <div className="form-group">
-              <label className="form-label">📱 פלטפורמת התקשרות</label>
-              <div className="platform-chips">
+              <label className="form-label" id={`${uid}-communication-platforms-label`}>📱 פלטפורמת התקשרות</label>
+              <div className="platform-chips" role="group" aria-labelledby={`${uid}-communication-platforms-label`}>
                 {[
                   { value: 'whatsapp', label: 'ווצאפ' },
                   { value: 'email', label: 'מייל' },
@@ -262,8 +271,9 @@ function ProjectModal({ project, clientHourlyRate, onSave, onClose, clientId = n
             </div>
 
             <div className="form-group">
-              <label className="form-label">⏱️ שעות משוערות</label>
+              <label className="form-label" htmlFor={`${uid}-estimated_hours`}>⏱️ שעות משוערות</label>
               <input
+                id={`${uid}-estimated_hours`}
                 type="number"
                 name="estimated_hours"
                 className="form-input"
@@ -278,8 +288,9 @@ function ProjectModal({ project, clientHourlyRate, onSave, onClose, clientId = n
             </div>
             
             <div className="form-group">
-              <label className="form-label">💵 סכום ששולם (₪)</label>
+              <label className="form-label" htmlFor={`${uid}-paid_amount`}>💵 סכום ששולם (₪)</label>
               <input
+                id={`${uid}-paid_amount`}
                 type="number"
                 name="paid_amount"
                 className="form-input"
@@ -293,8 +304,9 @@ function ProjectModal({ project, clientHourlyRate, onSave, onClose, clientId = n
             </div>
             
             <div className="form-group">
-              <label className="form-label">📝 פתק פרטי (לעצמך)</label>
+              <label className="form-label" htmlFor={`${uid}-notes`}>📝 פתק פרטי (לעצמך)</label>
               <textarea
+                id={`${uid}-notes`}
                 name="notes"
                 className="form-input notes-input"
                 value={formData.notes}
diff --git a/client/src/components/ProjectModal.test.jsx b/client/src/components/ProjectModal.test.jsx
new file mode 100644
index 0000000..fa0735a
--- /dev/null
+++ b/client/src/components/ProjectModal.test.jsx
@@ -0,0 +1,89 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+
+const apiMocks = vi.hoisted(() => ({
+  clientsAPI: { getAll: vi.fn() }
+}));
+
+vi.mock('../services/api', () => apiMocks);
+
+import ProjectModal from './ProjectModal';
+
+const { clientsAPI } = apiMocks;
+const clients = [
+  { id: 'c1', name: 'סטודיו דנה' },
+  { id: 'c2', name: 'יוסי ושות׳' }
+];
+
+beforeEach(() => {
+  clientsAPI.getAll.mockReset();
+  clientsAPI.getAll.mockResolvedValue(clients);
+});
+
+// Waits for the client list to load so the async state update happens inside the test
+const renderModal = async (props = {}) => {
+  const user = userEvent.setup();
+  const onSave = vi.fn().mockResolvedValue();
+  const onClose = vi.fn();
+  render(<ProjectModal onSave={onSave} onClose={onClose} {...props} />);
+  await screen.findByRole('option', { name: 'יוסי ושות׳' });
+  return { user, onSave, onClose };
+};
+
+describe('ProjectModal - labelled fields', () => {
+  it('exposes the main fields through their labels', async () => {
+    await renderModal();
+
+    const name = screen.getByLabelText('שם הפרויקט *');
+    expect(name.tagName).toBe('INPUT');
+    expect(name).toHaveAttribute('name', 'name');
+    expect(name).toBeRequired();
+
+    const client = screen.getByLabelText('לקוח *');
+    expect(client.tagName).toBe('SELECT');
+    expect(client).toHaveAttribute('name', 'client_id');
+
+    expect(screen.getByLabelText('תיאור')).toHaveAttribute('name', 'description');
+    expect(screen.getByLabelText('סוג תמחור')).toHaveAttribute('name', 'pricing_type');
+    expect(screen.getByLabelText('מחיר לשעה (₪)')).toHaveAttribute('name', 'hourly_rate');
+    expect(screen.getByLabelText('סטטוס')).toHaveAttribute('name', 'status');
+    expect(screen.getByLabelText('🎯 חשיבות')).toHaveAttribute('name', 'priority');
+    expect(screen.getByLabelText('⏱️ שעות משוערות')).toHaveAttribute('name', 'estimated_hours');
+    expect(screen.getByLabelText('💵 סכום ששולם (₪)')).toHaveAttribute('name', 'paid_amount');
+    expect(screen.getByLabelText('📝 פתק פרטי (לעצמך)')).toHaveAttribute('name', 'notes');
+  });
+
+  it('labels the communication platform chips as a group', async () => {
+    await renderModal();
+
+    const group = screen.getByRole('group', { name: '📱 פלטפורמת התקשרות' });
+    expect(group).toContainElement(screen.getByRole('button', { name: 'ווצאפ' }));
+  });
+
+  it('keeps the preselected client in the labelled select', async () => {
+    await renderModal({ clientId: 'c1' });
+
+    const client = screen.getByLabelText('לקוח *');
+    expect(client).toHaveValue('c1');
+    expect(client).toBeDisabled();
+  });
+
+  it('lets the user type into the labelled project name', async () => {
+    const { user } = await renderModal();
+
+    const name = screen.getByLabelText('שם הפרויקט *');
+    await user.type(name, 'אתר חדש');
+
+    expect(name).toHaveValue('אתר חדש');
+  });
+
+  it('labels the price field that matches the pricing type', async () => {
+    const { user } = await renderModal();
+
+    await user.selectOptions(screen.getByLabelText('סוג תמחור'), 'fixed');
+
+    expect(screen.getByLabelText('מחיר קבוע (₪)')).toHaveAttribute('name', 'fixed_price');
+    expect(screen.queryByLabelText('מחיר לשעה (₪)')).not.toBeInTheDocument();
+  });
+});
diff --git a/client/src/components/RemindersModal.jsx b/client/src/components/RemindersModal.jsx
index b9c0cb3..13d34f8 100644
--- a/client/src/components/RemindersModal.jsx
+++ b/client/src/components/RemindersModal.jsx
@@ -1,4 +1,4 @@
-import React, { useState, useEffect, useMemo, useRef } from 'react';
+import React, { useState, useEffect, useMemo, useRef, useId } from 'react';
 import { createPortal } from 'react-dom';
 import { X, ChevronDown, ChevronUp, Check } from 'lucide-react';
 import useStore from '../store/useStore';
@@ -11,6 +11,7 @@ const RemindersModal = ({ isOpen, onClose, reminder, initialAssociation }) => {
   const stableInitialAssociation = useMemo(() => initialAssociation || EMPTY_ASSOCIATION, [initialAssociation?.type, initialAssociation?.id]);
   const prevIsOpenRef = useRef(false);
   useBodyScrollLock(isOpen);
+  const uid = useId();
   const { addReminder, updateReminder } = useStore();
   const [formData, setFormData] = useState({
     content: '',
@@ -298,8 +299,9 @@ const RemindersModal = ({ isOpen, onClose, reminder, initialAssociation }) => {
         <form onSubmit={handleSubmit}>
           <div className="modal-body">
             <div className="form-group">
-                <label className="form-label">תאריך ושעה</label>
+                <label className="form-label" htmlFor={`${uid}-due-date`}>תאריך ושעה</label>
                 <input
+                id={`${uid}-due-date`}
                 className="form-input"
                 type="datetime-local"
                 required
@@ -311,18 +313,19 @@ const RemindersModal = ({ isOpen, onClose, reminder, initialAssociation }) => {
             <div className="form-group" style={{ flexDirection: 'row', alignItems: 'center', gap: '0.5rem' }}>
                 <input
                     type="checkbox"
-                    id="is_recurring"
+                    id={`${uid}-is_recurring`}
                     checked={formData.is_recurring}
                     onChange={e => setFormData({...formData, is_recurring: e.target.checked})}
                     style={{ width: 'auto' }}
                 />
-                <label htmlFor="is_recurring" className="form-label" style={{ marginBottom: 0, cursor: 'pointer' }}>תזכורת חוזרת</label>
+                <label htmlFor={`${uid}-is_recurring`} className="form-label" style={{ marginBottom: 0, cursor: 'pointer' }}>תזכורת חוזרת</label>
             </div>
 
             {formData.is_recurring && (
                 <div className="form-group">
-                <label className="form-label">תדירות חזרה</label>
+                <label className="form-label" htmlFor={`${uid}-recurrence-interval`}>תדירות חזרה</label>
                 <select
+                    id={`${uid}-recurrence-interval`}
                     className="form-input"
                     value={formData.recurrence_interval}
                     onChange={e => setFormData({...formData, recurrence_interval: e.target.value})}
@@ -336,8 +339,9 @@ const RemindersModal = ({ isOpen, onClose, reminder, initialAssociation }) => {
             )}
 
             <div className="form-group">
-                <label className="form-label">תוכן התזכורת</label>
+                <label className="form-label" htmlFor={`${uid}-content`}>תוכן התזכורת</label>
                 <textarea
+                id={`${uid}-content`}
                 className="form-input"
                 required
                 value={formData.content}
@@ -348,8 +352,9 @@ const RemindersModal = ({ isOpen, onClose, reminder, initialAssociation }) => {
             </div>
 
             <div className="form-group">
-                <label className="form-label">הערות</label>
+                <label className="form-label" htmlFor={`${uid}-notes`}>הערות</label>
                 <textarea
+                id={`${uid}-notes`}
                 className="form-input"
                 value={formData.notes}
                 onChange={e => setFormData({...formData, notes: e.target.value})}
@@ -361,8 +366,9 @@ const RemindersModal = ({ isOpen, onClose, reminder, initialAssociation }) => {
             {/* Lead association */}
             {leads.length > 0 && formData.association_type !== 'client' && formData.association_type !== 'project' && formData.association_type !== 'task' && (
               <div className="form-group">
-                <label className="form-label">שיוך לליד (אופציונלי)</label>
+                <label className="form-label" htmlFor={`${uid}-lead`}>שיוך לליד (אופציונלי)</label>
                 <select
+                  id={`${uid}-lead`}
                   className="form-input"
                   value={formData.association_type === 'lead' ? formData.association_id : ''}
                   onChange={e => {
@@ -384,8 +390,9 @@ const RemindersModal = ({ isOpen, onClose, reminder, initialAssociation }) => {
             )}
 
             <div className="form-group">
-                <label className="form-label">לקוח (אופציונלי)</label>
+                <label className="form-label" htmlFor={`${uid}-client`}>לקוח (אופציונלי)</label>
                 <select
+                id={`${uid}-client`}
                 className="form-input"
                 value={selectedClient}
                 onChange={e => handleClientChange(e.target.value)}
@@ -400,8 +407,8 @@ const RemindersModal = ({ isOpen, onClose, reminder, initialAssociation }) => {
 
             {/* Multi-select Projects */}
             <div className="form-group">
-              <label className="form-label">פרויקטים (אופציונלי)</label>
-              <div className="multi-select-dropdown" ref={projectsDropdownRef}>
+              <label className="form-label" id={`${uid}-projects-label`}>פרויקטים (אופציונלי)</label>
+              <div className="multi-select-dropdown" ref={projectsDropdownRef} role="group" aria-labelledby={`${uid}-projects-label`}>
                 <button
                   type="button"
                   className="form-input multi-select-trigger"
@@ -467,8 +474,9 @@ const RemindersModal = ({ isOpen, onClose, reminder, initialAssociation }) => {
 
             {selectedClient && (
                 <div className="form-group">
-                <label className="form-label">פרויקט ראשי (אופציונלי)</label>
+                <label className="form-label" htmlFor={`${uid}-main-project`}>פרויקט ראשי (אופציונלי)</label>
                 <select
+                    id={`${uid}-main-project`}
                     className="form-input"
                     value={selectedProject}
                     onChange={e => handleProjectChange(e.target.value)}
@@ -484,8 +492,9 @@ const RemindersModal = ({ isOpen, onClose, reminder, initialAssociation }) => {
 
             {selectedProject && (
                 <div className="form-group">
-                <label className="form-label">משימה (אופציונלי)</label>
+                <label className="form-label" htmlFor={`${uid}-task`}>משימה (אופציונלי)</label>
                 <select
+                    id={`${uid}-task`}
                     className="form-input"
                     value={formData.association_type === 'task' ? formData.association_id : ''}
                     onChange={e => handleTaskChange(e.target.value)}
diff --git a/client/src/components/RouteSuspense.jsx b/client/src/components/RouteSuspense.jsx
new file mode 100644
index 0000000..4670b6d
--- /dev/null
+++ b/client/src/components/RouteSuspense.jsx
@@ -0,0 +1,23 @@
+import { Suspense } from 'react';
+
+// Shown while a lazily loaded page (App.jsx) downloads its code
+export function RouteFallback({ fullPage = false }) {
+  return (
+    <div
+      className="loading route-loading"
+      role="status"
+      aria-label="טוען…"
+      style={fullPage ? { height: '100vh' } : { minHeight: '40vh' }}
+    >
+      <div className="spinner"></div>
+    </div>
+  );
+}
+
+// Suspense boundary for routed pages. Inside Layout it wraps only the <Outlet>, so the sidebar and
+// header stay on screen while the next page's chunk loads.
+function RouteSuspense({ children, fullPage = false }) {
+  return <Suspense fallback={<RouteFallback fullPage={fullPage} />}>{children}</Suspense>;
+}
+
+export default RouteSuspense;
diff --git a/client/src/components/ShareModal.jsx b/client/src/components/ShareModal.jsx
index f973012..82cdacf 100644
--- a/client/src/components/ShareModal.jsx
+++ b/client/src/components/ShareModal.jsx
@@ -1,4 +1,4 @@
-import { useState, useEffect } from 'react';
+import { useState, useEffect, useId } from 'react';
 import { createPortal } from 'react-dom';
 import { shareAPI } from '../services/api';
 import { useModal } from './Modal';
@@ -13,6 +13,7 @@ function ShareModal({
   onSuccess
 }) {
   const modal = useModal();
+  const uid = useId();
   const [shareType, setShareType] = useState('public');
   const [password, setPassword] = useState('');
   const [allowedEmail, setAllowedEmail] = useState('');
@@ -163,8 +164,9 @@ function ShareModal({
                     // Edit mode
                     <div className="link-edit-form">
                       <div className="form-group">
-                        <label>שם הלינק</label>
+                        <label htmlFor={`${uid}-edit-name-${link.id}`}>שם הלינק</label>
                         <input
+                          id={`${uid}-edit-name-${link.id}`}
                           type="text"
                           className="form-input"
                           value={editingLink.name || ''}
@@ -174,8 +176,9 @@ function ShareModal({
                       </div>
 
                       <div className="form-group">
-                        <label>סוג הגנה</label>
+                        <label htmlFor={`${uid}-edit-share-type-${link.id}`}>סוג הגנה</label>
                         <select
+                          id={`${uid}-edit-share-type-${link.id}`}
                           className="form-input"
                           value={editingLink.share_type}
                           onChange={e => setEditingLink({ ...editingLink, share_type: e.target.value })}
@@ -188,8 +191,9 @@ function ShareModal({
 
                       {editingLink.share_type === 'password' && (
                         <div className="form-group">
-                          <label>סיסמא חדשה (השאר ריק לשמירת הקיימת)</label>
+                          <label htmlFor={`${uid}-edit-password-${link.id}`}>סיסמא חדשה (השאר ריק לשמירת הקיימת)</label>
                           <input
+                            id={`${uid}-edit-password-${link.id}`}
                             type="password"
                             className="form-input"
                             value={editingLink.newPassword || ''}
@@ -201,8 +205,9 @@ function ShareModal({
 
                       {editingLink.share_type === 'email' && (
                         <div className="form-group">
-                          <label>כתובת מייל מורשית</label>
+                          <label htmlFor={`${uid}-edit-email-${link.id}`}>כתובת מייל מורשית</label>
                           <input
+                            id={`${uid}-edit-email-${link.id}`}
                             type="email"
                             className="form-input ltr"
                             value={editingLink.allowed_email || ''}
@@ -294,8 +299,9 @@ function ShareModal({
               <h3>{links.length > 0 ? 'צור לינק נוסף' : 'צור לינק שיתוף'}</h3>
 
               <div className="form-group">
-                <label>שם הלינק (אופציונלי)</label>
+                <label htmlFor={`${uid}-link-name`}>שם הלינק (אופציונלי)</label>
                 <input
+                  id={`${uid}-link-name`}
                   type="text"
                   className="form-input"
                   value={linkName}
@@ -305,8 +311,8 @@ function ShareModal({
               </div>
 
               <div className="form-group">
-                <label>סוג הגנה</label>
-                <div className="share-type-options">
+                <label id={`${uid}-share-type-label`}>סוג הגנה</label>
+                <div className="share-type-options" role="radiogroup" aria-labelledby={`${uid}-share-type-label`}>
                   <label className={`share-type-option ${shareType === 'public' ? 'selected' : ''}`}>
                     <input
                       type="radio"
@@ -350,8 +356,9 @@ function ShareModal({
 
               {shareType === 'password' && (
                 <div className="form-group">
-                  <label>סיסמא לצפייה</label>
+                  <label htmlFor={`${uid}-password`}>סיסמא לצפייה</label>
                   <input
+                    id={`${uid}-password`}
                     type="password"
                     className="form-input"
                     value={password}
@@ -364,8 +371,9 @@ function ShareModal({
 
               {shareType === 'email' && (
                 <div className="form-group">
-                  <label>כתובת מייל מורשית</label>
+                  <label htmlFor={`${uid}-allowed-email`}>כתובת מייל מורשית</label>
                   <input
+                    id={`${uid}-allowed-email`}
                     type="email"
                     className="form-input ltr"
                     value={allowedEmail}
diff --git a/client/src/components/SmartPaymentModal.jsx b/client/src/components/SmartPaymentModal.jsx
index d521401..a761714 100644
--- a/client/src/components/SmartPaymentModal.jsx
+++ b/client/src/components/SmartPaymentModal.jsx
@@ -1,4 +1,4 @@
-import { useState, useEffect, useMemo } from 'react';
+import { useState, useEffect, useMemo, useId } from 'react';
 import { createPortal } from 'react-dom';
 import { X, ChevronDown, ChevronUp, Edit2, Check, AlertCircle } from 'lucide-react';
 import { formatCurrency } from '../utils/format';
@@ -25,6 +25,7 @@ const PAYMENT_METHODS = [
  */
 function SmartPaymentModal({ client, projects, onSave, onClose }) {
   useBodyScrollLock(true);
+  const uid = useId();
 
   const [amount, setAmount] = useState('');
   const [paymentMethod, setPaymentMethod] = useState('bank_transfer');
@@ -146,10 +147,11 @@ function SmartPaymentModal({ client, projects, onSave, onClose }) {
           <div className="modal-body">
             {/* Amount Input */}
             <div className="form-group">
-              <label className="form-label">סכום שהתקבל</label>
+              <label className="form-label" htmlFor={`${uid}-amount`}>סכום שהתקבל</label>
               <div className="amount-input-wrapper">
                 <span className="currency-symbol">₪</span>
                 <input
+                  id={`${uid}-amount`}
                   type="number"
                   className="form-input amount-input"
                   value={amount}
@@ -181,8 +183,9 @@ function SmartPaymentModal({ client, projects, onSave, onClose }) {
             {/* Date & Payment Method */}
             <div className="form-row">
               <div className="form-group">
-                <label className="form-label">תאריך</label>
+                <label className="form-label" htmlFor={`${uid}-date`}>תאריך</label>
                 <input
+                  id={`${uid}-date`}
                   type="date"
                   className="form-input"
                   value={date}
@@ -192,8 +195,9 @@ function SmartPaymentModal({ client, projects, onSave, onClose }) {
                 />
               </div>
               <div className="form-group">
-                <label className="form-label">אמצעי תשלום</label>
+                <label className="form-label" htmlFor={`${uid}-payment-method`}>אמצעי תשלום</label>
                 <select
+                  id={`${uid}-payment-method`}
                   className="form-input"
                   value={paymentMethod}
                   onChange={e => setPaymentMethod(e.target.value)}
@@ -319,8 +323,9 @@ function SmartPaymentModal({ client, projects, onSave, onClose }) {
 
             {/* Notes */}
             <div className="form-group">
-              <label className="form-label">הערות</label>
+              <label className="form-label" htmlFor={`${uid}-notes`}>הערות</label>
               <textarea
+                id={`${uid}-notes`}
                 className="form-input"
                 value={notes}
                 onChange={e => setNotes(e.target.value)}
diff --git a/client/src/components/StatsBar.jsx b/client/src/components/StatsBar.jsx
index 05495f4..fefdfff 100644
--- a/client/src/components/StatsBar.jsx
+++ b/client/src/components/StatsBar.jsx
@@ -8,6 +8,42 @@ import './StatsBar.css';
 const toDateInputValue = (date) =>
   `${date.getFullYear()}-${String(date.getMonth() + 1).padStart(2, '0')}-${String(date.getDate()).padStart(2, '0')}`;
 
+// A dashboard range covers whole local calendar days: from local 00:00:00.000 of the first day to
+// local 23:59:59.999 of the last. new Date('YYYY-MM-DD') would be UTC midnight (03:00 in Israel).
+// The Dashboard sends these with toISOString(), i.e. as exact instants that the server uses as-is.
+export const buildLocalDayRange = (startValue, endValue) => {
+  const [startYear, startMonth, startDay] = String(startValue).split('-').map(Number);
+  const [endYear, endMonth, endDay] = String(endValue).split('-').map(Number);
+  return {
+    start: new Date(startYear, startMonth - 1, startDay, 0, 0, 0, 0),
+    end: new Date(endYear, endMonth - 1, endDay, 23, 59, 59, 999)
+  };
+};
+
+// The month of `date` as whole local days: the 1st 00:00:00.000 to the last day 23:59:59.999
+export const buildLocalMonthRange = (date) => ({
+  start: new Date(date.getFullYear(), date.getMonth(), 1, 0, 0, 0, 0),
+  end: new Date(date.getFullYear(), date.getMonth() + 1, 0, 23, 59, 59, 999)
+});
+
+// Query params for /stats/dashboard: the custom range, or else the selected month, as exact
+// instants of local start/end of day. month/year tell the server it is the month view.
+export const buildDashboardStatsParams = ({ dateRange, selectedMonth } = {}) => {
+  if (dateRange) {
+    return { startDate: dateRange.start.toISOString(), endDate: dateRange.end.toISOString() };
+  }
+  if (selectedMonth) {
+    const { start, end } = buildLocalMonthRange(selectedMonth);
+    return {
+      month: selectedMonth.getMonth(),
+      year: selectedMonth.getFullYear(),
+      startDate: start.toISOString(),
+      endDate: end.toISOString()
+    };
+  }
+  return {};
+};
+
 function StatsBar({ stats, selectedMonth, onMonthChange, dateRange, onDateRangeChange }) {
   const navigate = useNavigate();
   const [showDateModal, setShowDateModal] = useState(false);
@@ -58,9 +94,7 @@ function StatsBar({ stats, selectedMonth, onMonthChange, dateRange, onDateRangeC
 
   const handleApplyDateRange = () => {
     if (tempStartDate && tempEndDate) {
-      const start = new Date(tempStartDate);
-      const end = new Date(tempEndDate);
-      end.setHours(23, 59, 59, 999); // Include the entire end day
+      const { start, end } = buildLocalDayRange(tempStartDate, tempEndDate);
       
       if (start <= end) {
         onDateRangeChange?.({ start, end });
diff --git a/client/src/components/StatsBar.range.test.js b/client/src/components/StatsBar.range.test.js
new file mode 100644
index 0000000..8bbc29e
--- /dev/null
+++ b/client/src/components/StatsBar.range.test.js
@@ -0,0 +1,123 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { buildLocalDayRange, buildLocalMonthRange, buildDashboardStatsParams } from './StatsBar';
+import { statsAPI } from '../services/api';
+
+// vitest.config.js pins TZ to Asia/Jerusalem (UTC+2 in winter, UTC+3 in summer)
+describe('buildLocalDayRange', () => {
+  it('covers whole local calendar days, from 00:00:00.000 to 23:59:59.999', () => {
+    const { start, end } = buildLocalDayRange('2026-10-01', '2026-10-08');
+    expect(start).toEqual(new Date(2026, 9, 1, 0, 0, 0, 0));
+    expect(end).toEqual(new Date(2026, 9, 8, 23, 59, 59, 999));
+  });
+
+  it('a single day in Israel summer time is 21:00 UTC of the day before to 20:59:59.999 UTC', () => {
+    const { start, end } = buildLocalDayRange('2026-10-08', '2026-10-08');
+    expect(start.toISOString()).toBe('2026-10-07T21:00:00.000Z');
+    expect(end.toISOString()).toBe('2026-10-08T20:59:59.999Z');
+    // 01:00 on the 8th in Israel (22:00 UTC on the 7th) falls inside the 8th
+    const oneAm = new Date('2026-10-07T22:00:00.000Z');
+    expect(oneAm >= start && oneAm <= end).toBe(true);
+  });
+
+  it('follows the local offset in winter and across the DST switch', () => {
+    const winter = buildLocalDayRange('2026-01-15', '2026-01-15');
+    expect(winter.start.toISOString()).toBe('2026-01-14T22:00:00.000Z');
+    expect(winter.end.toISOString()).toBe('2026-01-15T21:59:59.999Z');
+
+    // Israel moves to summer time on Friday 27 March 2026 - a 23-hour day
+    const dstDay = buildLocalDayRange('2026-03-27', '2026-03-27');
+    expect(dstDay.start.toISOString()).toBe('2026-03-26T22:00:00.000Z');
+    expect(dstDay.end.toISOString()).toBe('2026-03-27T20:59:59.999Z');
+  });
+
+  it('handles month and year ends without rolling over', () => {
+    const { start, end } = buildLocalDayRange('2025-12-31', '2026-02-28');
+    expect(start).toEqual(new Date(2025, 11, 31));
+    expect(end).toEqual(new Date(2026, 1, 28, 23, 59, 59, 999));
+  });
+
+  it('an end before the start stays detectable (start > end)', () => {
+    const { start, end } = buildLocalDayRange('2026-10-05', '2026-10-01');
+    expect(start > end).toBe(true);
+  });
+});
+
+describe('buildLocalMonthRange', () => {
+  it('covers the local month, from the 1st at 00:00 to the last day at 23:59:59.999', () => {
+    const { start, end } = buildLocalMonthRange(new Date(2026, 9, 8, 12, 0));
+    expect(start).toEqual(new Date(2026, 9, 1, 0, 0, 0, 0));
+    expect(end).toEqual(new Date(2026, 9, 31, 23, 59, 59, 999));
+    // October in Israel starts at +03:00 and ends at +02:00 (summer time ends on Oct 25)
+    expect(start.toISOString()).toBe('2026-09-30T21:00:00.000Z');
+    expect(end.toISOString()).toBe('2026-10-31T21:59:59.999Z');
+  });
+
+  it('01:00 on the 1st in Israel belongs to that month, not the previous one', () => {
+    const oneAm = new Date('2026-10-31T23:00:00.000Z'); // Nov 1, 01:00 (+02:00)
+    const nov = buildLocalMonthRange(new Date(2026, 10, 15));
+    const oct = buildLocalMonthRange(new Date(2026, 9, 15));
+    expect(oneAm >= nov.start && oneAm <= nov.end).toBe(true);
+    expect(oneAm >= oct.start && oneAm <= oct.end).toBe(false);
+  });
+
+  it('uses the right last day (leap February, December)', () => {
+    expect(buildLocalMonthRange(new Date(2028, 1, 10)).end).toEqual(new Date(2028, 1, 29, 23, 59, 59, 999));
+    expect(buildLocalMonthRange(new Date(2026, 1, 10)).end).toEqual(new Date(2026, 1, 28, 23, 59, 59, 999));
+    const dec = buildLocalMonthRange(new Date(2026, 11, 31, 23, 0));
+    expect(dec.start).toEqual(new Date(2026, 11, 1));
+    expect(dec.end).toEqual(new Date(2026, 11, 31, 23, 59, 59, 999));
+  });
+});
+
+describe('buildDashboardStatsParams', () => {
+  it('month view: month/year plus the local month as instants', () => {
+    expect(buildDashboardStatsParams({ selectedMonth: new Date(2026, 10, 20, 9, 0) })).toEqual({
+      month: 10,
+      year: 2026,
+      startDate: '2026-10-31T22:00:00.000Z',
+      endDate: '2026-11-30T21:59:59.999Z'
+    });
+  });
+
+  it('a custom range wins over the selected month and is sent as instants only', () => {
+    const dateRange = buildLocalDayRange('2026-10-08', '2026-10-08');
+    expect(buildDashboardStatsParams({ dateRange, selectedMonth: new Date(2026, 9, 1) })).toEqual({
+      startDate: '2026-10-07T21:00:00.000Z',
+      endDate: '2026-10-08T20:59:59.999Z'
+    });
+  });
+
+  it('sends nothing without a range or a month (server default)', () => {
+    expect(buildDashboardStatsParams({})).toEqual({});
+    expect(buildDashboardStatsParams()).toEqual({});
+  });
+});
+
+describe('dashboard stats request for a local range', () => {
+  beforeEach(() => {
+    vi.stubGlobal('fetch', vi.fn().mockResolvedValue({ ok: true, status: 200, text: () => Promise.resolve('{}') }));
+  });
+
+  it('sends the range as exact UTC instants, URL-encoded', async () => {
+    const range = buildLocalDayRange('2026-10-08', '2026-10-08');
+    // The same conversion the Dashboard does with the range it gets from StatsBar
+    await statsAPI.getDashboard({ startDate: range.start.toISOString(), endDate: range.end.toISOString() });
+
+    const url = new URL(fetch.mock.calls[0][0], 'http://localhost');
+    expect(url.pathname).toBe('/api/stats/dashboard');
+    expect(url.searchParams.get('startDate')).toBe('2026-10-07T21:00:00.000Z');
+    expect(url.searchParams.get('endDate')).toBe('2026-10-08T20:59:59.999Z');
+  });
+
+  it('sends the month view with month/year and the local month instants', async () => {
+    await statsAPI.getDashboard(buildDashboardStatsParams({ selectedMonth: new Date(2026, 10, 1) }));
+
+    const url = new URL(fetch.mock.calls[0][0], 'http://localhost');
+    expect(Object.fromEntries(url.searchParams)).toEqual({
+      month: '10',
+      year: '2026',
+      startDate: '2026-10-31T22:00:00.000Z',
+      endDate: '2026-11-30T21:59:59.999Z'
+    });
+  });
+});
diff --git a/client/src/components/StatsBar.test.jsx b/client/src/components/StatsBar.test.jsx
index ab8d110..c024ec1 100644
--- a/client/src/components/StatsBar.test.jsx
+++ b/client/src/components/StatsBar.test.jsx
@@ -211,9 +211,8 @@ describe('StatsBar - date range modal', () => {
     expect(screen.queryByRole('heading', { name: 'בחירת טווח תאריכים' })).not.toBeInTheDocument();
   });
 
-  // The start is parsed as UTC midnight (03:00 in Israel) and server/routes/stats.js snaps the range
-  // to UTC days, so the dashboard window is shifted by the UTC offset - needs a client+server decision
-  it.fails('starts the applied range at local midnight of the chosen day', async () => {
+  // Ranges are the user's local calendar days; the Dashboard sends them as exact instants
+  it('starts the applied range at local midnight of the chosen day', async () => {
     const { onDateRangeChange } = renderBar({ selectedMonth: new Date() });
     await userEvent.click(currentButton());
 
@@ -221,7 +220,11 @@ describe('StatsBar - date range modal', () => {
     fireEvent.change(endInput(), { target: { value: '2026-09-15' } });
     await userEvent.click(screen.getByRole('button', { name: 'החל טווח' }));
 
-    expect(onDateRangeChange.mock.calls[0][0].start).toEqual(new Date(2026, 8, 1, 0, 0, 0, 0));
+    const { start, end } = onDateRangeChange.mock.calls[0][0];
+    expect(start).toEqual(new Date(2026, 8, 1, 0, 0, 0, 0));
+    // Israel is UTC+3 in September: local midnight is 21:00 UTC of the previous day
+    expect(start.toISOString()).toBe('2026-08-31T21:00:00.000Z');
+    expect(end.toISOString()).toBe('2026-09-15T20:59:59.999Z');
   });
 
   it('accepts a single-day range', async () => {
diff --git a/client/src/components/SubtaskModal.jsx b/client/src/components/SubtaskModal.jsx
index 7f702cd..69160ca 100644
--- a/client/src/components/SubtaskModal.jsx
+++ b/client/src/components/SubtaskModal.jsx
@@ -1,4 +1,4 @@
-import { useState, useEffect, useRef } from 'react';
+import { useState, useEffect, useRef, useId } from 'react';
 import { createPortal } from 'react-dom';
 import { X } from 'lucide-react';
 import useBodyScrollLock from '../hooks/useBodyScrollLock';
@@ -6,6 +6,7 @@ import { tasksAPI, projectsAPI } from '../services/api';
 
 function SubtaskModal({ subtask, onSave, onClose }) {
   useBodyScrollLock(true);
+  const uid = useId();
   const formRef = useRef(null);
   const [formData, setFormData] = useState({
     title: '',
@@ -107,8 +108,9 @@ function SubtaskModal({ subtask, onSave, onClose }) {
         <form ref={formRef} onSubmit={handleSubmit}>
           <div className="modal-body">
             <div className="form-group">
-              <label className="form-label">כותרת *</label>
+              <label className="form-label" htmlFor={`${uid}-title`}>כותרת *</label>
               <input
+                id={`${uid}-title`}
                 type="text"
                 name="title"
                 className="form-input"
@@ -120,8 +122,9 @@ function SubtaskModal({ subtask, onSave, onClose }) {
 
             {subtask && allTasks.length > 0 && (
               <div className="form-group">
-                <label className="form-label">שיוך למשימה</label>
+                <label className="form-label" htmlFor={`${uid}-task_id`}>שיוך למשימה</label>
                 <select
+                  id={`${uid}-task_id`}
                   name="task_id"
                   className="form-input"
                   value={formData.task_id}
@@ -150,8 +153,9 @@ function SubtaskModal({ subtask, onSave, onClose }) {
             )}
 
             <div className="form-group">
-              <label className="form-label">תאריך יעד</label>
+              <label className="form-label" htmlFor={`${uid}-due_date`}>תאריך יעד</label>
               <input
+                id={`${uid}-due_date`}
                 type="date"
                 name="due_date"
                 className="form-input"
@@ -162,8 +166,9 @@ function SubtaskModal({ subtask, onSave, onClose }) {
             </div>
 
             <div className="form-group">
-              <label className="form-label">עדיפות</label>
+              <label className="form-label" htmlFor={`${uid}-priority`}>עדיפות</label>
               <select
+                id={`${uid}-priority`}
                 name="priority"
                 className="form-input"
                 defaultValue={formData.priority}
@@ -176,8 +181,8 @@ function SubtaskModal({ subtask, onSave, onClose }) {
             </div>
 
             <div className="form-group">
-              <label className="form-label">📱 פלטפורמת התקשרות</label>
-              <div className="platform-chips">
+              <label className="form-label" id={`${uid}-communication-platforms-label`}>📱 פלטפורמת התקשרות</label>
+              <div className="platform-chips" role="group" aria-labelledby={`${uid}-communication-platforms-label`}>
                 {[
                   { value: 'whatsapp', label: 'ווצאפ' },
                   { value: 'email', label: 'מייל' },
@@ -198,8 +203,9 @@ function SubtaskModal({ subtask, onSave, onClose }) {
             </div>
 
             <div className="form-group">
-              <label className="form-label">תיאור</label>
+              <label className="form-label" htmlFor={`${uid}-description`}>תיאור</label>
               <textarea
+                id={`${uid}-description`}
                 name="description"
                 className="form-input"
                 defaultValue={formData.description}
diff --git a/client/src/components/TaskModal.jsx b/client/src/components/TaskModal.jsx
index 87fec11..a53ec0b 100644
--- a/client/src/components/TaskModal.jsx
+++ b/client/src/components/TaskModal.jsx
@@ -1,4 +1,4 @@
-import { useState, useEffect, useRef } from 'react';
+import { useState, useEffect, useRef, useId } from 'react';
 import { createPortal } from 'react-dom';
 import { X } from 'lucide-react';
 import useBodyScrollLock from '../hooks/useBodyScrollLock';
@@ -6,6 +6,7 @@ import { projectsAPI, clientsAPI } from '../services/api';
 
 function TaskModal({ task, projectHourlyRate, projectPricingType, onSave, onClose }) {
   useBodyScrollLock(true);
+  const uid = useId();
   const formRef = useRef(null);
   const [formData, setFormData] = useState({
     name: '',
@@ -129,8 +130,9 @@ function TaskModal({ task, projectHourlyRate, projectPricingType, onSave, onClos
         <form ref={formRef} onSubmit={handleSubmit}>
           <div className="modal-body">
             <div className="form-group">
-              <label className="form-label">שם המשימה *</label>
+              <label className="form-label" htmlFor={`${uid}-name`}>שם המשימה *</label>
               <input
+                id={`${uid}-name`}
                 type="text"
                 name="name"
                 className="form-input"
@@ -142,8 +144,9 @@ function TaskModal({ task, projectHourlyRate, projectPricingType, onSave, onClos
             
             {task && allProjects.length > 0 && (
               <div className="form-group">
-                <label className="form-label">שיוך לפרויקט</label>
+                <label className="form-label" htmlFor={`${uid}-project_id`}>שיוך לפרויקט</label>
                 <select
+                  id={`${uid}-project_id`}
                   name="project_id"
                   className="form-input"
                   value={formData.project_id}
@@ -172,8 +175,9 @@ function TaskModal({ task, projectHourlyRate, projectPricingType, onSave, onClos
             )}
 
             <div className="form-group">
-              <label className="form-label">תיאור</label>
+              <label className="form-label" htmlFor={`${uid}-description`}>תיאור</label>
               <textarea
+                id={`${uid}-description`}
                 name="description"
                 className="form-input"
                 defaultValue={formData.description}
@@ -183,8 +187,9 @@ function TaskModal({ task, projectHourlyRate, projectPricingType, onSave, onClos
             </div>
 
             <div className="form-group">
-              <label className="form-label">סוג תמחור</label>
+              <label className="form-label" htmlFor={`${uid}-pricing_type`}>סוג תמחור</label>
               <select
+                id={`${uid}-pricing_type`}
                 name="pricing_type"
                 className="form-input"
                 value={formData.pricing_type}
@@ -198,8 +203,9 @@ function TaskModal({ task, projectHourlyRate, projectPricingType, onSave, onClos
             
             {pricingType === 'hourly' && (
               <div className="form-group">
-                <label className="form-label">מחיר לשעה (₪)</label>
+                <label className="form-label" htmlFor={`${uid}-hourly_rate`}>מחיר לשעה (₪)</label>
                 <input
+                  id={`${uid}-hourly_rate`}
                   type="number"
                   name="hourly_rate"
                   className="form-input"
@@ -214,8 +220,9 @@ function TaskModal({ task, projectHourlyRate, projectPricingType, onSave, onClos
             )}
             
             <div className="form-group">
-              <label className="form-label">סטטוס</label>
+              <label className="form-label" htmlFor={`${uid}-status`}>סטטוס</label>
               <select
+                id={`${uid}-status`}
                 name="status"
                 className="form-input"
                 defaultValue={formData.status}
@@ -231,8 +238,9 @@ function TaskModal({ task, projectHourlyRate, projectPricingType, onSave, onClos
             </div>
             
             <div className="form-group">
-              <label className="form-label">🎯 חשיבות</label>
+              <label className="form-label" htmlFor={`${uid}-priority`}>🎯 חשיבות</label>
               <select
+                id={`${uid}-priority`}
                 name="priority"
                 className="form-input"
                 defaultValue={formData.priority}
@@ -245,8 +253,8 @@ function TaskModal({ task, projectHourlyRate, projectPricingType, onSave, onClos
             </div>
             
             <div className="form-group">
-              <label className="form-label">📱 פלטפורמת התקשרות</label>
-              <div className="platform-chips">
+              <label className="form-label" id={`${uid}-communication-platforms-label`}>📱 פלטפורמת התקשרות</label>
+              <div className="platform-chips" role="group" aria-labelledby={`${uid}-communication-platforms-label`}>
                 {[
                   { value: 'whatsapp', label: 'ווצאפ' },
                   { value: 'email', label: 'מייל' },
@@ -267,8 +275,9 @@ function TaskModal({ task, projectHourlyRate, projectPricingType, onSave, onClos
             </div>
 
             <div className="form-group">
-              <label className="form-label">⏱️ שעות משוערות</label>
+              <label className="form-label" htmlFor={`${uid}-estimated_hours`}>⏱️ שעות משוערות</label>
               <input
+                id={`${uid}-estimated_hours`}
                 type="number"
                 name="estimated_hours"
                 className="form-input"
@@ -283,8 +292,9 @@ function TaskModal({ task, projectHourlyRate, projectPricingType, onSave, onClos
             </div>
             
             <div className="form-group">
-              <label className="form-label">💵 סכום ששולם (₪)</label>
+              <label className="form-label" htmlFor={`${uid}-paid_amount`}>💵 סכום ששולם (₪)</label>
               <input
+                id={`${uid}-paid_amount`}
                 type="number"
                 name="paid_amount"
                 className="form-input"
@@ -298,8 +308,9 @@ function TaskModal({ task, projectHourlyRate, projectPricingType, onSave, onClos
             </div>
             
             <div className="form-group">
-              <label className="form-label">📝 פתק פרטי (לעצמך)</label>
+              <label className="form-label" htmlFor={`${uid}-notes`}>📝 פתק פרטי (לעצמך)</label>
               <textarea
+                id={`${uid}-notes`}
                 name="notes"
                 className="form-input notes-input"
                 defaultValue={formData.notes}
diff --git a/client/src/components/TimeEntryModal.jsx b/client/src/components/TimeEntryModal.jsx
index 9c91659..e354929 100644
--- a/client/src/components/TimeEntryModal.jsx
+++ b/client/src/components/TimeEntryModal.jsx
@@ -1,4 +1,4 @@
-import { useState, useEffect, useRef, useMemo } from 'react';
+import { useState, useEffect, useRef, useMemo, useId } from 'react';
 import { createPortal } from 'react-dom';
 import { Timer, Plus, Trash2, ChevronDown, ChevronUp, Link2, Sparkles, FolderOpen, CheckSquare } from 'lucide-react';
 import useBodyScrollLock from '../hooks/useBodyScrollLock';
@@ -7,6 +7,7 @@ import { formatDurationHuman } from '../utils/format';
 
 function TimeEntryModal({ entry, projectId, taskId, clientId, durationSeconds, startTime: propStartTime, endTime: propEndTime, isFromTimer = false, onSave, onClose }) {
   useBodyScrollLock(true);
+  const uid = useId();
   const formRef = useRef(null);
 
   // Intervals state
@@ -620,8 +621,9 @@ function TimeEntryModal({ entry, projectId, taskId, clientId, durationSeconds, s
             )}
 
             <div className="form-group">
-              <label className="form-label">לקוח</label>
+              <label className="form-label" htmlFor={`${uid}-client_id`}>לקוח</label>
               <select
+                id={`${uid}-client_id`}
                 name="client_id"
                 className="form-input"
                 value={formData.client_id}
@@ -671,8 +673,9 @@ function TimeEntryModal({ entry, projectId, taskId, clientId, durationSeconds, s
             )}
 
             <div className="form-group">
-              <label className="form-label">פרויקט (אופציונלי)</label>
+              <label className="form-label" htmlFor={`${uid}-project_id`}>פרויקט (אופציונלי)</label>
               <select
+                id={`${uid}-project_id`}
                 name="project_id"
                 className="form-input"
                 value={showNewProject ? '__new__' : formData.project_id}
@@ -715,8 +718,9 @@ function TimeEntryModal({ entry, projectId, taskId, clientId, durationSeconds, s
             </div>
 
             <div className="form-group">
-              <label className="form-label">משימה (אופציונלי)</label>
+              <label className="form-label" htmlFor={`${uid}-task_id`}>משימה (אופציונלי)</label>
               <select
+                id={`${uid}-task_id`}
                 name="task_id"
                 className="form-input"
                 value={showNewTask ? '__new__' : formData.task_id}
@@ -760,8 +764,9 @@ function TimeEntryModal({ entry, projectId, taskId, clientId, durationSeconds, s
 
             {formData.task_id && subtasks.length > 0 && (
               <div className="form-group">
-                <label className="form-label">תת-משימה (אופציונלי)</label>
+                <label className="form-label" htmlFor={`${uid}-subtask_id`}>תת-משימה (אופציונלי)</label>
                 <select
+                  id={`${uid}-subtask_id`}
                   name="subtask_id"
                   className="form-input"
                   value={formData.subtask_id}
@@ -879,8 +884,8 @@ function TimeEntryModal({ entry, projectId, taskId, clientId, durationSeconds, s
                       <span className="interval-edit-number">{index + 1}</span>
 
                       <div className="interval-edit-fields">
-                        <div className="interval-edit-row">
-                          <label>התחלה:</label>
+                        <div className="interval-edit-row" role="group" aria-labelledby={`${uid}-start-label-${index}`}>
+                          <label id={`${uid}-start-label-${index}`}>התחלה:</label>
                           <input
                             type="date"
                             value={interval.start_date_input || formatDateForInput(interval.start_time)}
@@ -896,8 +901,8 @@ function TimeEntryModal({ entry, projectId, taskId, clientId, durationSeconds, s
                             dir="ltr"
                           />
                         </div>
-                        <div className="interval-edit-row">
-                          <label>סיום:</label>
+                        <div className="interval-edit-row" role="group" aria-labelledby={`${uid}-end-label-${index}`}>
+                          <label id={`${uid}-end-label-${index}`}>סיום:</label>
                           <input
                             type="date"
                             value={interval.end_date_input || formatDateForInput(interval.end_time)}
@@ -958,8 +963,9 @@ function TimeEntryModal({ entry, projectId, taskId, clientId, durationSeconds, s
                 {formData.use_duration ? (
                   <>
                     <div className="form-group">
-                      <label className="form-label">תאריך</label>
+                      <label className="form-label" htmlFor={`${uid}-start_date`}>תאריך</label>
                       <input
+                        id={`${uid}-start_date`}
                         type="date"
                         name="start_date"
                         className="form-input"
@@ -971,8 +977,9 @@ function TimeEntryModal({ entry, projectId, taskId, clientId, durationSeconds, s
                     </div>
 
                     <div className="form-group">
-                      <label className="form-label">שעת התחלה</label>
+                      <label className="form-label" htmlFor={`${uid}-start_time`}>שעת התחלה</label>
                       <input
+                        id={`${uid}-start_time`}
                         type="time"
                         name="start_time"
                         className="form-input"
@@ -985,8 +992,9 @@ function TimeEntryModal({ entry, projectId, taskId, clientId, durationSeconds, s
 
                     <div className="form-row">
                       <div className="form-group">
-                        <label className="form-label">שעות</label>
+                        <label className="form-label" htmlFor={`${uid}-duration_hours`}>שעות</label>
                         <input
+                          id={`${uid}-duration_hours`}
                           type="number"
                           name="duration_hours"
                           className="form-input"
@@ -998,8 +1006,9 @@ function TimeEntryModal({ entry, projectId, taskId, clientId, durationSeconds, s
                         />
                       </div>
                       <div className="form-group">
-                        <label className="form-label">דקות</label>
+                        <label className="form-label" htmlFor={`${uid}-duration_minutes`}>דקות</label>
                         <input
+                          id={`${uid}-duration_minutes`}
                           type="number"
                           name="duration_minutes"
                           className="form-input"
@@ -1017,8 +1026,9 @@ function TimeEntryModal({ entry, projectId, taskId, clientId, durationSeconds, s
                   <div className="time-range-container">
                     <div className="form-row time-row">
                       <div className="form-group date-group">
-                        <label className="form-label">תאריך התחלה</label>
+                        <label className="form-label" htmlFor={`${uid}-start_date`}>תאריך התחלה</label>
                         <input
+                          id={`${uid}-start_date`}
                           type="date"
                           name="start_date"
                           className="form-input"
@@ -1029,8 +1039,9 @@ function TimeEntryModal({ entry, projectId, taskId, clientId, durationSeconds, s
                         />
                       </div>
                       <div className="form-group time-group">
-                        <label className="form-label">שעה</label>
+                        <label className="form-label" htmlFor={`${uid}-start_time`}>שעה</label>
                         <input
+                          id={`${uid}-start_time`}
                           type="time"
                           name="start_time"
                           className="form-input"
@@ -1044,8 +1055,9 @@ function TimeEntryModal({ entry, projectId, taskId, clientId, durationSeconds, s
 
                     <div className="form-row time-row">
                       <div className="form-group date-group">
-                        <label className="form-label">תאריך סיום</label>
+                        <label className="form-label" htmlFor={`${uid}-end_date`}>תאריך סיום</label>
                         <input
+                          id={`${uid}-end_date`}
                           type="date"
                           name="end_date"
                           className="form-input"
@@ -1056,8 +1068,9 @@ function TimeEntryModal({ entry, projectId, taskId, clientId, durationSeconds, s
                         />
                       </div>
                       <div className="form-group time-group">
-                        <label className="form-label">שעה</label>
+                        <label className="form-label" htmlFor={`${uid}-end_time`}>שעה</label>
                         <input
+                          id={`${uid}-end_time`}
                           type="time"
                           name="end_time"
                           className="form-input"
@@ -1085,8 +1098,9 @@ function TimeEntryModal({ entry, projectId, taskId, clientId, durationSeconds, s
             )}
 
             <div className="form-group">
-              <label className="form-label">הערות</label>
+              <label className="form-label" htmlFor={`${uid}-notes`}>הערות</label>
               <textarea
+                id={`${uid}-notes`}
                 name="notes"
                 className="form-input"
                 value={formData.notes}
diff --git a/client/src/components/TimerConflictModal.jsx b/client/src/components/TimerConflictModal.jsx
index 6c729a5..add846d 100644
--- a/client/src/components/TimerConflictModal.jsx
+++ b/client/src/components/TimerConflictModal.jsx
@@ -1,4 +1,4 @@
-import { useState, useEffect } from 'react';
+import { useState, useEffect, useId } from 'react';
 import { createPortal } from 'react-dom';
 import useStore from '../store/useStore';
 import { formatDuration } from '../utils/format';
@@ -7,6 +7,7 @@ import './TimerConflictModal.css';
 
 function TimerConflictModal({ onCancel, onContinue, onStopTimer, targetProject, targetTask }) {
   useBodyScrollLock(true);
+  const uid = useId();
   const { activeTimers, stopTimer } = useStore();
   const [selectedTimerId, setSelectedTimerId] = useState(null);
   const [notes, setNotes] = useState('');
@@ -64,8 +65,9 @@ function TimerConflictModal({ onCancel, onContinue, onStopTimer, targetProject,
             </div>
             
             <div className="form-group">
-              <label className="form-label">הערות לטיימר שנעצר (אופציונלי)</label>
+              <label className="form-label" htmlFor={`${uid}-notes`}>הערות לטיימר שנעצר (אופציונלי)</label>
               <textarea 
+                id={`${uid}-notes`}
                 className="form-input"
                 value={notes}
                 onChange={e => setNotes(e.target.value)}
diff --git a/client/src/pages/Addons.css b/client/src/pages/Addons.css
deleted file mode 100644
index 594b1fb..0000000
--- a/client/src/pages/Addons.css
+++ /dev/null
@@ -1,269 +0,0 @@
-/* Addons Page */
-.addons-page {
-  max-width: 900px;
-}
-
-.addons-page .page-header {
-  margin-bottom: 1.5rem;
-}
-
-.addons-page .page-title-section {
-  display: flex;
-  align-items: flex-start;
-  gap: 1rem;
-}
-
-.addons-page .page-icon {
-  color: var(--primary);
-  flex-shrink: 0;
-  margin-top: 0.25rem;
-}
-
-.addons-page .page-title {
-  margin-bottom: 0.25rem;
-}
-
-.addons-page .page-subtitle {
-  color: var(--text-secondary);
-  font-size: 0.9rem;
-  margin: 0;
-}
-
-/* Info Banner */
-.addons-info-banner {
-  display: flex;
-  align-items: center;
-  gap: 0.75rem;
-  padding: 1rem 1.25rem;
-  background: var(--bg-secondary);
-  border: 1px solid var(--border);
-  border-radius: 0.75rem;
-  margin-bottom: 1.5rem;
-  font-size: 0.875rem;
-  color: var(--text-secondary);
-}
-
-.addons-info-banner svg {
-  color: var(--primary);
-  flex-shrink: 0;
-}
-
-/* Addons Grid */
-.addons-grid {
-  display: grid;
-  grid-template-columns: repeat(auto-fill, minmax(280px, 1fr));
-  gap: 1.25rem;
-}
-
-/* Addon Card */
-.addon-card {
-  display: flex;
-  flex-direction: column;
-  padding: 1.5rem;
-  transition: all 0.2s ease;
-  border: 2px solid transparent;
-}
-
-.addon-card.enabled {
-  border-color: var(--success);
-  background: linear-gradient(135deg, rgba(16, 185, 129, 0.05) 0%, transparent 100%);
-}
-
-.addon-card.disabled {
-  opacity: 0.8;
-}
-
-.addon-card.updating {
-  pointer-events: none;
-  opacity: 0.7;
-}
-
-.addon-card:hover {
-  transform: translateY(-2px);
-  box-shadow: 0 8px 24px rgba(0, 0, 0, 0.15);
-}
-
-/* Addon Header */
-.addon-header {
-  display: flex;
-  align-items: flex-start;
-  gap: 1rem;
-  margin-bottom: 1rem;
-}
-
-.addon-icon-wrapper {
-  width: 48px;
-  height: 48px;
-  border-radius: 12px;
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  background: var(--bg-secondary);
-  color: var(--text-secondary);
-  flex-shrink: 0;
-  transition: all 0.2s ease;
-}
-
-.addon-icon-wrapper.active {
-  background: var(--primary);
-  color: white;
-}
-
-.addon-title-section {
-  flex: 1;
-  min-width: 0;
-}
-
-.addon-name {
-  font-size: 1.1rem;
-  font-weight: 600;
-  margin: 0 0 0.25rem 0;
-  color: var(--text-primary);
-}
-
-.addon-status {
-  font-size: 0.75rem;
-  font-weight: 500;
-  padding: 0.2rem 0.5rem;
-  border-radius: 4px;
-}
-
-.addon-status.enabled {
-  background: rgba(16, 185, 129, 0.15);
-  color: var(--success);
-}
-
-.addon-status.disabled {
-  background: var(--bg-secondary);
-  color: var(--text-secondary);
-}
-
-/* Addon Description */
-.addon-description {
-  flex: 1;
-  font-size: 0.875rem;
-  color: var(--text-secondary);
-  line-height: 1.5;
-  margin: 0 0 1.25rem 0;
-}
-
-/* Addon Footer */
-.addon-footer {
-  display: flex;
-  justify-content: flex-end;
-  padding-top: 1rem;
-  border-top: 1px solid var(--border);
-}
-
-/* Toggle Button */
-.addon-toggle {
-  display: flex;
-  align-items: center;
-  gap: 0.75rem;
-  padding: 0.5rem 1rem;
-  border: none;
-  border-radius: 9999px;
-  cursor: pointer;
-  transition: all 0.2s ease;
-  font-size: 0.875rem;
-  font-weight: 500;
-}
-
-.addon-toggle.toggle-on {
-  background: var(--success);
-  color: white;
-}
-
-.addon-toggle.toggle-off {
-  background: var(--bg-secondary);
-  color: var(--text-secondary);
-}
-
-.addon-toggle:hover:not(:disabled) {
-  transform: scale(1.02);
-}
-
-.addon-toggle:disabled {
-  cursor: not-allowed;
-}
-
-/* Toggle Track */
-.toggle-track {
-  width: 36px;
-  height: 20px;
-  border-radius: 9999px;
-  position: relative;
-  transition: all 0.2s ease;
-}
-
-.toggle-on .toggle-track {
-  background: rgba(255, 255, 255, 0.3);
-}
-
-.toggle-off .toggle-track {
-  background: var(--border);
-}
-
-/* Toggle Thumb */
-.toggle-thumb {
-  position: absolute;
-  width: 16px;
-  height: 16px;
-  border-radius: 50%;
-  top: 2px;
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  transition: all 0.2s ease;
-}
-
-.toggle-on .toggle-thumb {
-  right: 2px;
-  background: white;
-  color: var(--success);
-}
-
-.toggle-off .toggle-thumb {
-  left: 2px;
-  background: var(--text-secondary);
-  color: var(--bg);
-}
-
-/* Toggle Spinner */
-.toggle-spinner {
-  width: 10px;
-  height: 10px;
-  border: 2px solid transparent;
-  border-top-color: currentColor;
-  border-radius: 50%;
-  animation: spin 0.6s linear infinite;
-}
-
-@keyframes spin {
-  to {
-    transform: rotate(360deg);
-  }
-}
-
-/* Toggle Label */
-.toggle-label {
-  min-width: 2.5rem;
-}
-
-/* Responsive */
-@media (max-width: 640px) {
-  .addons-grid {
-    grid-template-columns: 1fr;
-  }
-  
-  .addons-page .page-title-section {
-    flex-direction: column;
-    gap: 0.5rem;
-  }
-  
-  .addons-info-banner {
-    flex-direction: column;
-    text-align: center;
-  }
-}
-
diff --git a/client/src/pages/Addons.jsx b/client/src/pages/Addons.jsx
deleted file mode 100644
index ddca3a1..0000000
--- a/client/src/pages/Addons.jsx
+++ /dev/null
@@ -1,163 +0,0 @@
-import { useState, useEffect } from 'react';
-import { Key, FileText, StickyNote, Puzzle, Check, X, Info, Target, Bell, Calendar } from 'lucide-react';
-import { addonsAPI } from '../services/api';
-import useStore from '../store/useStore';
-import { useModal } from '../components/Modal';
-import './Addons.css';
-
-// מיפוי אייקונים לפי שם התוסף
-const ADDON_ICONS = {
-  credentials: Key,
-  files: FileText,
-  notes: StickyNote,
-  leads_management: Target,
-  reminders: Bell,
-  schedule: Calendar
-};
-
-function Addons() {
-  const modal = useModal();
-  const { loadEnabledAddons } = useStore();
-  const [addons, setAddons] = useState([]);
-  const [loading, setLoading] = useState(true);
-  const [updating, setUpdating] = useState(null);
-
-  useEffect(() => {
-    loadAddons();
-  }, []);
-
-  const loadAddons = async () => {
-    try {
-      const data = await addonsAPI.getAll();
-      setAddons(data);
-    } catch (error) {
-      console.error('Failed to load addons:', error);
-      modal.error('שגיאה בטעינת התוספים');
-    } finally {
-      setLoading(false);
-    }
-  };
-
-  const handleToggle = async (addonId, currentState) => {
-    setUpdating(addonId);
-    try {
-      await addonsAPI.update(addonId, !currentState);
-      
-      // עדכון local state
-      setAddons(prev => prev.map(addon => 
-        addon.id === addonId 
-          ? { ...addon, isEnabled: !currentState }
-          : addon
-      ));
-      
-      // עדכון global state
-      await loadEnabledAddons();
-      
-      modal.success(
-        !currentState 
-          ? `התוסף "${addons.find(a => a.id === addonId)?.name}" הופעל בהצלחה` 
-          : `התוסף "${addons.find(a => a.id === addonId)?.name}" הושבת`
-      );
-    } catch (error) {
-      console.error('Failed to toggle addon:', error);
-      modal.error('שגיאה בעדכון התוסף');
-    } finally {
-      setUpdating(null);
-    }
-  };
-
-  if (loading) {
-    return (
-      <div className="loading">
-        <div className="spinner"></div>
-      </div>
-    );
-  }
-
-  return (
-    <div className="page fade-in addons-page">
-      <div className="page-header">
-        <div className="page-title-section">
-          <Puzzle className="page-icon" size={28} />
-          <div>
-            <h1 className="page-title">תוספים</h1>
-            <p className="page-subtitle">
-              הפעל או כבה יכולות נוספות באפליקציה. כל תוסף מוסיף טאב חדש בעמודי לקוחות ופרויקטים.
-            </p>
-          </div>
-        </div>
-      </div>
-
-      <div className="addons-info-banner">
-        <Info size={20} />
-        <span>
-          הערה: כיבוי תוסף לא מוחק את הנתונים שכבר שמרת. אם תפעיל את התוסף מחדש, הנתונים יהיו שם.
-        </span>
-      </div>
-
-      <div className="addons-grid">
-        {addons.map(addon => {
-          const Icon = ADDON_ICONS[addon.id] || Puzzle;
-          const isUpdating = updating === addon.id;
-          
-          return (
-            <div 
-              key={addon.id} 
-              className={`addon-card card ${addon.isEnabled ? 'enabled' : 'disabled'} ${isUpdating ? 'updating' : ''}`}
-            >
-              <div className="addon-header">
-                <div className={`addon-icon-wrapper ${addon.isEnabled ? 'active' : ''}`}>
-                  <Icon size={24} />
-                </div>
-                <div className="addon-title-section">
-                  <h3 className="addon-name">{addon.name}</h3>
-                  <span className={`addon-status ${addon.isEnabled ? 'enabled' : 'disabled'}`}>
-                    {addon.isEnabled ? 'מופעל' : 'מושבת'}
-                  </span>
-                </div>
-              </div>
-              
-              <p className="addon-description">{addon.description}</p>
-              
-              <div className="addon-footer">
-                <button
-                  className={`addon-toggle ${addon.isEnabled ? 'toggle-on' : 'toggle-off'}`}
-                  onClick={() => handleToggle(addon.id, addon.isEnabled)}
-                  disabled={isUpdating}
-                >
-                  <span className="toggle-track">
-                    <span className="toggle-thumb">
-                      {isUpdating ? (
-                        <span className="toggle-spinner"></span>
-                      ) : addon.isEnabled ? (
-                        <Check size={12} />
-                      ) : (
-                        <X size={12} />
-                      )}
-                    </span>
-                  </span>
-                  <span className="toggle-label">
-                    {addon.isEnabled ? 'פעיל' : 'כבוי'}
-                  </span>
-                </button>
-              </div>
-            </div>
-          );
-        })}
-      </div>
-
-      {addons.length === 0 && (
-        <div className="empty-state card">
-          <div className="empty-state-icon">
-            <Puzzle size={48} strokeWidth={1.5} />
-          </div>
-          <h3 className="empty-state-title">אין תוספים זמינים</h3>
-          <p>תוספים חדשים יופיעו כאן בעתיד</p>
-        </div>
-      )}
-    </div>
-  );
-}
-
-export default Addons;
-
diff --git a/client/src/pages/CatalogPage.jsx b/client/src/pages/CatalogPage.jsx
index cb0d402..66636d4 100644
--- a/client/src/pages/CatalogPage.jsx
+++ b/client/src/pages/CatalogPage.jsx
@@ -227,9 +227,9 @@ function CatalogPage() {
                       <div className="catalog-item-price">
                         <DollarSign size={16} />
                         <span className="price-value ltr">
-                          {item.price ? formatCurrency(item.price) : 'לא הוגדר'}
+                          {item.price != null ? formatCurrency(item.price) : 'לא הוגדר'}
                         </span>
-                        {item.price && (
+                        {item.price != null && (
                           <span className="price-type">
                             / {item.unit || getPricingTypeLabel(item.pricing_type)}
                           </span>
diff --git a/client/src/pages/ClientDetail.jsx b/client/src/pages/ClientDetail.jsx
index 5e1358d..d447a74 100644
--- a/client/src/pages/ClientDetail.jsx
+++ b/client/src/pages/ClientDetail.jsx
@@ -1,4 +1,4 @@
-import { useState, useEffect, useCallback } from 'react';
+import { useState, useEffect, useCallback, useId } from 'react';
 import { createPortal } from 'react-dom';
 import { useParams, Link, useNavigate, useOutletContext } from 'react-router-dom';
 import { Plus, Edit2, Trash2, Play, Pause, Square, X, Mail, Phone, Building2, Bell, Folder, Clock, DollarSign, RotateCw, Star, MessageSquare, Globe, CreditCard, Share2, Link as LinkIcon, Lock, TrendingUp, Key, FileText, StickyNote, CheckSquare, Circle, CircleCheck, Copy } from 'lucide-react';
@@ -38,6 +38,7 @@ function ClientDetail() {
   const navigate = useNavigate();
   const { setStats: setGlobalStats } = useOutletContext();
   const modal = useModal();
+  const uid = useId();
   const { activeTimers, startTimer, pauseTimer, resumeTimer, stopTimer, discardTimer, getTimerForProject, integrations, isAddonEnabled } = useStore();
 
   const [client, setClient] = useState(null);
@@ -1585,8 +1586,9 @@ function ClientDetail() {
               </div>
 
               <div className="form-group">
-                <label className="form-label">הערות (אופציונלי)</label>
+                <label className="form-label" htmlFor={`${uid}-stop-notes`}>הערות (אופציונלי)</label>
                 <textarea
+                  id={`${uid}-stop-notes`}
                   className="form-input"
                   value={stopNotes}
                   onChange={e => setStopNotes(e.target.value)}
@@ -1623,9 +1625,10 @@ function ClientDetail() {
               </div>
 
               <div className="form-group">
-                <label className="form-label">שייך לפרויקט *</label>
+                <label className="form-label" htmlFor={`${uid}-client-timer-project`}>שייך לפרויקט *</label>
                 {projects.length > 0 ? (
                   <select
+                    id={`${uid}-client-timer-project`}
                     className="form-input"
                     value={selectedProjectForTimer}
                     onChange={e => setSelectedProjectForTimer(e.target.value)}
@@ -1643,8 +1646,9 @@ function ClientDetail() {
               </div>
 
               <div className="form-group">
-                <label className="form-label">הערות (אופציונלי)</label>
+                <label className="form-label" htmlFor={`${uid}-client-timer-notes`}>הערות (אופציונלי)</label>
                 <textarea
+                  id={`${uid}-client-timer-notes`}
                   className="form-input"
                   value={clientTimerNotes}
                   onChange={e => setClientTimerNotes(e.target.value)}
diff --git a/client/src/pages/Dashboard.jsx b/client/src/pages/Dashboard.jsx
index 9da4727..ae11729 100644
--- a/client/src/pages/Dashboard.jsx
+++ b/client/src/pages/Dashboard.jsx
@@ -1,4 +1,4 @@
-import React, { useState, useEffect, useRef, useCallback } from 'react';
+import React, { useState, useEffect, useRef, useCallback, useId } from 'react';
 import { createPortal } from 'react-dom';
 import { Link, useNavigate, useOutletContext } from 'react-router-dom';
 import { Users, Folder, Play, Pause, Square, X, ChevronRight, ChevronDown, Clock, Plus, MessageSquare, Search, CheckCircle2, ExternalLink, Circle, CircleCheck, Star, GripVertical, MoreVertical } from 'lucide-react';
@@ -14,6 +14,7 @@ import TaskModal from '../components/TaskModal';
 import TimeEntryModal from '../components/TimeEntryModal';
 import Forum from '../components/Forum';
 import PaymentStatusBadge, { calculateProjectEarnings } from '../components/PaymentStatusBadge';
+import { buildDashboardStatsParams } from '../components/StatsBar';
 import './Dashboard.css';
 
 const DEFAULT_CLIENT_ORDER = { favorites: [], nonFavorites: [] };
@@ -58,6 +59,7 @@ function Dashboard() {
   const selectedMonth = outletContext?.selectedMonth;
   const dateRange = outletContext?.dateRange;
   const modal = useModal();
+  const uid = useId();
   const [clients, setClients] = useState([]);
   const [projects, setProjects] = useState([]);
   const [tasks, setTasks] = useState([]);
@@ -148,23 +150,8 @@ function Dashboard() {
   // Reload stats when selectedMonth or dateRange changes
   useEffect(() => {
     const reloadStats = async () => {
-      let statsParams = {};
-      
-      if (dateRange) {
-        // Custom date range mode
-        statsParams = {
-          startDate: dateRange.start.toISOString(),
-          endDate: dateRange.end.toISOString()
-        };
-      } else if (selectedMonth) {
-        // Monthly mode
-        statsParams = {
-          month: selectedMonth.getMonth(),
-          year: selectedMonth.getFullYear()
-        };
-      }
-      
-      await loadDashboardStats(statsParams);
+      // Custom range or selected month, as the user's local calendar days
+      await loadDashboardStats(buildDashboardStatsParams({ dateRange, selectedMonth }));
     };
     reloadStats();
   }, [selectedMonth, dateRange, loadDashboardStats]);
@@ -1612,8 +1599,9 @@ function Dashboard() {
               </div>
 
               <div className="form-group">
-                <label className="form-label">הערות (אופציונלי)</label>
+                <label className="form-label" htmlFor={`${uid}-stop-notes`}>הערות (אופציונלי)</label>
                 <textarea
+                  id={`${uid}-stop-notes`}
                   className="form-input"
                   value={stopNotes}
                   onChange={e => setStopNotes(e.target.value)}
diff --git a/client/src/pages/Login.jsx b/client/src/pages/Login.jsx
index ba5d1d2..5b03ae8 100644
--- a/client/src/pages/Login.jsx
+++ b/client/src/pages/Login.jsx
@@ -1,4 +1,4 @@
-import { useState, useEffect } from 'react';
+import { useState } from 'react';
 import { Link, useNavigate, useSearchParams } from 'react-router-dom';
 import { KeyRound } from 'lucide-react';
 import { startAuthentication, browserSupportsWebAuthn } from '@simplewebauthn/browser';
@@ -6,15 +6,14 @@ import useStore from '../store/useStore';
 import { useModal } from '../components/Modal';
 import { authAPI, passkeysAPI } from '../services/api';
 
+const RESET_REQUIRED_ERROR = 'חובה לשנות סיסמה כדי להמשיך';
+
 function Login() {
   const [email, setEmail] = useState('');
   const [password, setPassword] = useState('');
   const [error, setError] = useState('');
   const [loading, setLoading] = useState(false);
   const [passkeyLoading, setPasskeyLoading] = useState(false);
-  const [showPasswordResetModal, setShowPasswordResetModal] = useState(false);
-  const [userId, setUserId] = useState(null);
-  const [currentPassword, setCurrentPassword] = useState('');
   const { login, completeAuth } = useStore();
   const navigate = useNavigate();
   const modal = useModal();
@@ -43,6 +42,11 @@ function Login() {
       const { flowId, options } = await passkeysAPI.loginOptions();
       const authResponse = await startAuthentication({ optionsJSON: options });
       const response = await passkeysAPI.loginVerify({ flowId, response: authResponse });
+      if (response?.requiresPasswordReset) {
+        setPasskeyLoading(false);
+        await runForcedPasswordReset(response);
+        return;
+      }
       await completeAuth(response);
       navigateAfterAuth();
     } catch (err) {
@@ -65,91 +69,74 @@ function Login() {
     handlePasskeyLogin();
   };
 
-  const handleSubmit = async (e) => {
-    e.preventDefault();
-    setError('');
-    setLoading(true);
-    
-    try {
-      const response = await login(email, password);
-      console.log('Login response:', response);
-      
-      // Check if password reset is required
-      if (response && response.requiresPasswordReset) {
-        console.log('Password reset required! Opening modal...');
-        setUserId(response.user.id);
-        setCurrentPassword(password);
-        setShowPasswordResetModal(true);
-        setLoading(false);
-        return;
-      }
-      
-      navigateAfterAuth();
-    } catch (err) {
-      console.error('Login error:', err);
-      setError(err.message);
-    } finally {
-      setLoading(false);
-    }
-  };
-  
-  // Show password reset modal when needed
-  useEffect(() => {
-    if (!showPasswordResetModal) return;
-    
-    console.log('useEffect triggered - showing password reset modal');
-    
-    const doPasswordReset = async () => {
-      console.log('handlePasswordReset called');
+  // The admin flagged this account for a forced password reset. Instead of a session the server
+  // sent a short-lived resetToken (useStore.completeAuth leaves the user logged out), so the user
+  // only gets in after setting a new password here - the reset response is the session.
+  const runForcedPasswordReset = async ({ resetToken }) => {
+    for (;;) {
       const newPassword = await modal.prompt(
         'הזן סיסמה חדשה (לפחות 4 תווים):',
-        { 
+        {
           title: 'נדרש איפוס סיסמה',
           placeholder: 'סיסמה חדשה',
-          type: 'password'
+          inputType: 'password',
+          autoComplete: 'new-password'
         }
       );
-      
-      console.log('User entered password:', newPassword ? '[HIDDEN]' : 'null/cancelled');
-      
+
       if (!newPassword) {
-        // User cancelled - log them out
-        console.log('User cancelled password reset');
-        setShowPasswordResetModal(false);
-        setError('חובה לשנות סיסמה כדי להמשיך');
+        // Cancelled: stay logged out on the login page
+        setError(RESET_REQUIRED_ERROR);
         return;
       }
-      
+
       if (newPassword.length < 4) {
-        console.log('Password too short, asking again');
         await modal.error('סיסמה חייבת להכיל לפחות 4 תווים');
-        // Try again
-        setTimeout(() => doPasswordReset(), 100);
-        return;
+        continue;
       }
-      
+
+      let session;
       try {
-        console.log('Calling resetPassword API...');
-        await authAPI.resetPassword({
-          userId,
-          oldPassword: currentPassword,
-          newPassword
-        });
-        
-        console.log('Password reset successful');
-        setShowPasswordResetModal(false);
-        await modal.success('סיסמה שונתה בהצלחה!');
-        navigate('/');
+        session = await authAPI.resetPassword({ resetToken, newPassword });
       } catch (err) {
-        console.error('Password reset error:', err);
+        // Expired reset token (401) or too many attempts (429): asking again won't help - sign in again
+        if (err.status === 401 || err.status === 429) {
+          setError(err.message);
+          return;
+        }
         await modal.error(err.message || 'שגיאה בשינוי סיסמה');
-        // Try again
-        setTimeout(() => doPasswordReset(), 100);
+        continue;
       }
-    };
-    
-    doPasswordReset();
-  }, [showPasswordResetModal, userId, currentPassword, modal, navigate]);
+
+      await modal.success('סיסמה שונתה בהצלחה!');
+      await completeAuth(session);
+      navigateAfterAuth();
+      return;
+    }
+  };
+
+  const handleSubmit = async (e) => {
+    e.preventDefault();
+    setError('');
+    setLoading(true);
+
+    let response;
+    try {
+      response = await login(email, password);
+    } catch (err) {
+      setError(err.message);
+      setLoading(false);
+      return;
+    }
+    setLoading(false);
+
+    if (response?.requiresPasswordReset) {
+      await runForcedPasswordReset(response);
+      return;
+    }
+
+    navigateAfterAuth();
+  };
   
   return (
     <div>
diff --git a/client/src/pages/Login.test.jsx b/client/src/pages/Login.test.jsx
index ec71538..fc7acca 100644
--- a/client/src/pages/Login.test.jsx
+++ b/client/src/pages/Login.test.jsx
@@ -28,6 +28,9 @@ const { authAPI, passkeysAPI, timerAPI, addonsAPI } = apiMocks;
 const initialState = useStore.getState();
 
 const workspace = { id: 'ws-1', name: 'אישי', role: 'owner' };
+// What the server sends instead of a session when the admin flagged the account
+const resetRequired = () => ({ requiresPasswordReset: true, resetToken: 'reset-jwt' });
+
 const authResponse = (extra = {}) => ({
   user: { id: 'u1', name: 'דנה', email: 'dana@example.com' },
   token: 'jwt-token',
@@ -212,7 +215,7 @@ describe('Login - password login', () => {
 
 describe('Login - forced password reset', () => {
   it('asks for a new password instead of going to the dashboard', async () => {
-    authAPI.login.mockResolvedValue(authResponse({ requiresPasswordReset: true }));
+    authAPI.login.mockResolvedValue(resetRequired());
     const user = renderLogin();
 
     await fillAndSubmit(user, 'dana@example.com', 'old-pw');
@@ -222,23 +225,83 @@ describe('Login - forced password reset', () => {
     expect(screen.queryByText('דשבורד')).not.toBeInTheDocument();
   });
 
+  it('does not log the user in before the password was reset', async () => {
+    authAPI.login.mockResolvedValue(resetRequired());
+    const user = renderLogin();
+
+    await fillAndSubmit(user, 'dana@example.com', 'old-pw');
+    await screen.findByRole('heading', { name: 'נדרש איפוס סיסמה' });
+
+    expect(useStore.getState().isAuthenticated).toBe(false);
+    expect(useStore.getState().user).toBeNull();
+    expect(localStorage.getItem('token')).toBeNull();
+    expect(localStorage.getItem('currentWorkspaceId')).toBeNull();
+  });
+
   it('resets the password with the old one and then continues to the dashboard', async () => {
-    authAPI.login.mockResolvedValue(authResponse({ requiresPasswordReset: true }));
-    authAPI.resetPassword.mockResolvedValue({ success: true });
+    authAPI.login.mockResolvedValue(resetRequired());
+    authAPI.resetPassword.mockResolvedValue({ message: 'סיסמה שונתה בהצלחה', ...authResponse(), token: 'session-after-reset' });
     const user = renderLogin();
 
     await fillAndSubmit(user, 'dana@example.com', 'old-pw');
     await user.type(await screen.findByPlaceholderText('סיסמה חדשה'), 'new-pw');
     await user.click(screen.getByRole('button', { name: 'אישור' }));
 
-    expect(authAPI.resetPassword).toHaveBeenCalledWith({ userId: 'u1', oldPassword: 'old-pw', newPassword: 'new-pw' });
+    expect(authAPI.resetPassword).toHaveBeenCalledWith({ resetToken: 'reset-jwt', newPassword: 'new-pw' });
     expect(await screen.findByText('סיסמה שונתה בהצלחה!')).toBeInTheDocument();
     await user.click(screen.getByRole('button', { name: 'אישור' }));
     expect(await screen.findByText('דשבורד')).toBeInTheDocument();
+    expect(useStore.getState().isAuthenticated).toBe(true);
+    expect(localStorage.getItem('token')).toBe('session-after-reset');
+    expect(localStorage.getItem('currentWorkspaceId')).toBe('ws-1');
+  });
+
+  it('continues to a pending workspace invite after the reset', async () => {
+    localStorage.setItem('pendingInviteCode', 'ABC123');
+    authAPI.login.mockResolvedValue(resetRequired());
+    authAPI.resetPassword.mockResolvedValue({ ...authResponse(), token: 'reset-token' });
+    const user = renderLogin();
+
+    await fillAndSubmit(user);
+    await user.type(await screen.findByPlaceholderText('סיסמה חדשה'), 'new-pw');
+    await user.click(screen.getByRole('button', { name: 'אישור' }));
+    await user.click(await screen.findByRole('button', { name: 'אישור' }));
+
+    expect(await screen.findByText('הצטרפות ABC123')).toBeInTheDocument();
+  });
+
+  it('shows a failed reset and asks again', async () => {
+    authAPI.login.mockResolvedValue(resetRequired());
+    authAPI.resetPassword.mockRejectedValue(Object.assign(new Error('הסיסמה החדשה חייבת להיות שונה מהסיסמה הנוכחית'), { status: 400 }));
+    const user = renderLogin();
+
+    await fillAndSubmit(user);
+    await user.type(await screen.findByPlaceholderText('סיסמה חדשה'), 'new-pw');
+    await user.click(screen.getByRole('button', { name: 'אישור' }));
+
+    expect(await screen.findByText('הסיסמה החדשה חייבת להיות שונה מהסיסמה הנוכחית')).toBeInTheDocument();
+    await user.click(screen.getByRole('button', { name: 'אישור' }));
+    expect(await screen.findByRole('heading', { name: 'נדרש איפוס סיסמה' })).toBeInTheDocument();
+    expect(useStore.getState().isAuthenticated).toBe(false);
+  });
+
+  it('an expired reset token ends the reset: the user signs in again', async () => {
+    authAPI.login.mockResolvedValue(resetRequired());
+    authAPI.resetPassword.mockRejectedValue(Object.assign(new Error('תוקף האיפוס פג. התחבר שוב כדי להגדיר סיסמה חדשה'), { status: 401 }));
+    const user = renderLogin();
+
+    await fillAndSubmit(user);
+    await user.type(await screen.findByPlaceholderText('סיסמה חדשה'), 'new-pw');
+    await user.click(screen.getByRole('button', { name: 'אישור' }));
+
+    expect(await screen.findByText('תוקף האיפוס פג. התחבר שוב כדי להגדיר סיסמה חדשה')).toHaveClass('auth-error');
+    expect(screen.queryByRole('heading', { name: 'נדרש איפוס סיסמה' })).not.toBeInTheDocument();
+    expect(authAPI.resetPassword).toHaveBeenCalledTimes(1);
+    expect(useStore.getState().isAuthenticated).toBe(false);
   });
 
   it('shows an error when the reset prompt is cancelled', async () => {
-    authAPI.login.mockResolvedValue(authResponse({ requiresPasswordReset: true }));
+    authAPI.login.mockResolvedValue(resetRequired());
     const user = renderLogin();
 
     await fillAndSubmit(user);
@@ -247,10 +310,12 @@ describe('Login - forced password reset', () => {
 
     expect(await screen.findByText('חובה לשנות סיסמה כדי להמשיך')).toBeInTheDocument();
     expect(authAPI.resetPassword).not.toHaveBeenCalled();
+    expect(useStore.getState().isAuthenticated).toBe(false);
+    expect(localStorage.getItem('token')).toBeNull();
   });
 
   it('rejects a new password shorter than 4 characters and asks again', async () => {
-    authAPI.login.mockResolvedValue(authResponse({ requiresPasswordReset: true }));
+    authAPI.login.mockResolvedValue(resetRequired());
     const user = renderLogin();
 
     await fillAndSubmit(user);
@@ -264,15 +329,16 @@ describe('Login - forced password reset', () => {
     expect(await screen.findByRole('heading', { name: 'נדרש איפוס סיסמה' })).toBeInTheDocument();
   });
 
-  // Login passes { type: 'password' } to modal.prompt, but prompt() uses `type` as the modal
-  // style and CustomModal always renders <input type="text">, so the new password is visible
-  it.fails('masks the new password while it is typed', async () => {
-    authAPI.login.mockResolvedValue(authResponse({ requiresPasswordReset: true }));
+  it('masks the new password while it is typed', async () => {
+    authAPI.login.mockResolvedValue(resetRequired());
     const user = renderLogin();
 
     await fillAndSubmit(user);
 
-    expect(await screen.findByPlaceholderText('סיסמה חדשה')).toHaveAttribute('type', 'password');
+    const input = await screen.findByLabelText('הזן סיסמה חדשה (לפחות 4 תווים):');
+    expect(input).toHaveAttribute('type', 'password');
+    expect(input).toHaveAttribute('autocomplete', 'new-password');
+    expect(input).toHaveAttribute('placeholder', 'סיסמה חדשה');
   });
 });
 
@@ -293,6 +359,24 @@ describe('Login - passkey', () => {
     expect(localStorage.getItem('token')).toBe('jwt-token');
   });
 
+  it('a flagged account signing in with a passkey sets a new password first', async () => {
+    passkeysAPI.loginOptions.mockResolvedValue({ flowId: 'flow-1', options: {} });
+    webauthn.startAuthentication.mockResolvedValue({ id: 'cred-1' });
+    passkeysAPI.loginVerify.mockResolvedValue(resetRequired());
+    authAPI.resetPassword.mockResolvedValue({ ...authResponse(), token: 'session-after-reset' });
+    const user = renderLogin();
+
+    await user.click(screen.getByRole('button', { name: 'התחבר עם Passkey' }));
+    await user.type(await screen.findByLabelText('הזן סיסמה חדשה (לפחות 4 תווים):'), 'new-pw');
+    expect(useStore.getState().isAuthenticated).toBe(false);
+    await user.click(screen.getByRole('button', { name: 'אישור' }));
+    await user.click(await screen.findByRole('button', { name: 'אישור' }));
+
+    expect(await screen.findByText('דשבורד')).toBeInTheDocument();
+    expect(authAPI.resetPassword).toHaveBeenCalledWith({ resetToken: 'reset-jwt', newPassword: 'new-pw' });
+    expect(localStorage.getItem('token')).toBe('session-after-reset');
+  });
+
   it('shows a waiting state while the browser dialog is open', async () => {
     passkeysAPI.loginOptions.mockReturnValue(new Promise(() => {}));
     const user = renderLogin();
diff --git a/client/src/pages/MarketingFunnels.css b/client/src/pages/MarketingFunnels.css
deleted file mode 100644
index 3f95641..0000000
--- a/client/src/pages/MarketingFunnels.css
+++ /dev/null
@@ -1,396 +0,0 @@
-.marketing-funnels-page {
-  padding-bottom: 2rem;
-}
-
-.view-toggle {
-  display: flex;
-  background: var(--bg-secondary);
-  padding: 4px;
-  border-radius: var(--radius-md);
-  gap: 4px;
-  width: fit-content;
-}
-
-.view-toggle-btn {
-  display: flex;
-  align-items: center;
-  gap: 6px;
-  padding: 6px 12px;
-  border-radius: var(--radius-sm);
-  border: none;
-  background: transparent;
-  color: var(--text-secondary);
-  font-size: 0.9rem;
-  cursor: pointer;
-  transition: all 0.2s;
-}
-
-.view-toggle-btn.active {
-  background: var(--bg-card);
-  color: var(--text-primary);
-  box-shadow: 0 1px 2px rgba(0, 0, 0, 0.05);
-  font-weight: 500;
-}
-
-.view-toggle-btn:hover:not(.active) {
-  background: rgba(0, 0, 0, 0.05);
-  color: var(--text-primary);
-}
-
-/* List View Styles */
-.funnels-list {
-  display: flex;
-  flex-direction: column;
-  gap: 1rem;
-}
-
-.funnel-item {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  flex-wrap: wrap;
-  gap: 0.75rem;
-  padding: 1rem;
-  background: var(--bg-card);
-  border-radius: var(--radius-lg);
-  border: 1px solid var(--border-color);
-  transition: border-color 0.2s;
-}
-
-.funnel-item:hover {
-  border-color: var(--primary-color);
-}
-
-.funnel-info {
-  display: flex;
-  align-items: center;
-  gap: 1rem;
-}
-
-.funnel-icon {
-  width: 40px;
-  height: 40px;
-  border-radius: 50%;
-  background: var(--bg-secondary);
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  color: var(--primary-color);
-}
-
-.funnel-details h3 {
-  margin: 0 0 4px 0;
-  font-size: 1rem;
-}
-
-.funnel-source-type {
-  font-size: 0.8rem;
-  color: var(--text-secondary);
-  background: var(--bg-secondary);
-  padding: 2px 6px;
-  border-radius: 4px;
-}
-
-.funnel-stats {
-  display: flex;
-  gap: 2rem;
-}
-
-.stat-box {
-  text-align: center;
-}
-
-.stat-value {
-  display: block;
-  font-size: 1.1rem;
-  font-weight: 600;
-  color: var(--text-primary);
-}
-
-.stat-label {
-  font-size: 0.8rem;
-  color: var(--text-secondary);
-}
-
-/* Chart View Styles */
-.funnel-chart-container {
-  padding: 2rem;
-  background: var(--bg-card);
-  border-radius: var(--radius-lg);
-  border: 1px solid var(--border-color);
-  min-height: 400px;
-  display: flex;
-  flex-direction: column;
-  align-items: center;
-  position: relative;
-  overflow: hidden;
-}
-
-.chart-sources {
-  display: flex;
-  justify-content: center;
-  gap: 2rem;
-  flex-wrap: wrap;
-  width: 100%;
-  margin-bottom: 4rem;
-  z-index: 2;
-}
-
-.chart-node {
-  background: var(--bg-card);
-  border: 2px solid var(--border-color);
-  border-radius: var(--radius-md);
-  padding: 1rem;
-  min-width: 140px;
-  text-align: center;
-  position: relative;
-  transition: all 0.3s;
-  box-shadow: 0 4px 6px rgba(0, 0, 0, 0.05);
-}
-
-.chart-node.source-node:hover {
-  transform: translateY(-5px);
-  border-color: var(--primary-color);
-}
-
-.chart-node.target-node {
-  background: var(--primary-color);
-  color: white;
-  border: none;
-  padding: 1.5rem 2rem;
-  margin-top: 2rem;
-  z-index: 2;
-}
-
-.chart-node-icon {
-  margin-bottom: 0.5rem;
-  display: inline-flex;
-  padding: 8px;
-  border-radius: 50%;
-  background: var(--bg-secondary);
-  color: var(--primary-color);
-}
-
-.target-node .chart-node-icon {
-  background: rgba(255, 255, 255, 0.2);
-  color: white;
-}
-
-.chart-node-title {
-  font-weight: 600;
-  margin-bottom: 0.25rem;
-}
-
-.chart-node-value {
-  font-size: 0.9rem;
-  opacity: 0.8;
-}
-
-/* Connecting Lines (Simple CSS Implementation) */
-.connections-layer {
-  position: absolute;
-  top: 0;
-  left: 0;
-  width: 100%;
-  height: 100%;
-  pointer-events: none;
-  z-index: 1;
-}
-
-.connection-line {
-  position: absolute;
-  background: var(--border-color);
-  width: 2px;
-  transform-origin: top center;
-}
-
-/* For simplicity in this demo, we'll use SVG for lines if possible, 
-   but strictly CSS requires complex calculations or hardcoded positions.
-   We'll use a simpler visual flow: Sources -> Arrows -> Main Funnel */
-
-.flow-arrow-down {
-  display: flex;
-  justify-content: center;
-  margin: -2rem 0 0;
-  color: var(--border-color);
-  padding-bottom: 1rem;
-}
-
-.merge-point {
-  width: 4px;
-  height: 60px;
-  background: var(--border-color);
-  margin: 0 auto;
-  position: relative;
-}
-
-.merge-point::after {
-  content: '';
-  position: absolute;
-  bottom: 0;
-  left: 50%;
-  transform: translateX(-50%);
-  border-left: 6px solid transparent;
-  border-right: 6px solid transparent;
-  border-top: 8px solid var(--border-color);
-}
-
-/* Header Actions */
-.header-actions {
-  display: flex;
-  align-items: center;
-  gap: 1rem;
-}
-
-/* Expandable Funnel Items */
-.funnel-item-wrapper {
-  display: flex;
-  flex-direction: column;
-}
-
-.funnel-item.clickable {
-  cursor: pointer;
-}
-
-.funnel-item.no-source {
-  opacity: 0.7;
-}
-
-.expand-icon {
-  color: var(--text-secondary);
-  margin-right: 0.5rem;
-}
-
-/* Source Clients List */
-.source-clients-list {
-  background: var(--bg-secondary);
-  border: 1px solid var(--border-color);
-  border-top: none;
-  border-radius: 0 0 var(--radius-lg) var(--radius-lg);
-  padding: 0.5rem;
-}
-
-.source-client-item {
-  display: flex;
-  align-items: center;
-  gap: 1rem;
-  padding: 0.6rem 1rem;
-  background: var(--bg-card);
-  border-radius: var(--radius-md);
-  margin-bottom: 0.35rem;
-  transition: background 0.15s;
-}
-
-.source-client-item:hover {
-  background: var(--bg-card-hover);
-}
-
-.source-client-item:last-child {
-  margin-bottom: 0;
-}
-
-.client-name {
-  font-weight: 500;
-  color: var(--text-primary);
-  flex: 1;
-  min-width: 0;
-  white-space: nowrap;
-  overflow: hidden;
-  text-overflow: ellipsis;
-}
-
-/* Sub Source Button */
-.sub-source-btn {
-  display: inline-flex;
-  align-items: center;
-  gap: 0.35rem;
-  font-size: 0.8rem;
-  color: var(--text-muted);
-  background: transparent;
-  border: 1px dashed var(--border-color);
-  padding: 0.25rem 0.6rem;
-  border-radius: var(--radius-sm);
-  cursor: pointer;
-  transition: all 0.2s;
-}
-
-.sub-source-btn:hover {
-  border-color: var(--accent-primary);
-  color: var(--accent-primary);
-  background: rgba(99, 102, 241, 0.05);
-}
-
-.sub-source-btn.has-value {
-  border-style: solid;
-  border-color: var(--success);
-  color: var(--success);
-  background: rgba(16, 185, 129, 0.1);
-}
-
-.sub-source-btn.has-value:hover {
-  background: rgba(16, 185, 129, 0.15);
-}
-
-/* Source Edit Container */
-.source-edit-container {
-  display: flex;
-  align-items: center;
-  gap: 0.35rem;
-  flex-wrap: wrap;
-}
-
-.source-select {
-  padding: 0.25rem 0.5rem !important;
-  padding-left: 1.5rem !important;
-  font-size: 0.85rem !important;
-  width: 130px;
-  height: 28px;
-  background-position: left 0.3rem center !important;
-}
-
-.sub-source-input {
-  padding: 0.25rem 0.5rem !important;
-  font-size: 0.85rem !important;
-  width: 120px;
-  height: 28px;
-}
-
-.client-date {
-  font-size: 0.8rem;
-  color: var(--text-muted);
-  min-width: 80px;
-  text-align: left;
-}
-
-/* Empty State */
-.empty-state {
-  display: flex;
-  flex-direction: column;
-  align-items: center;
-  justify-content: center;
-  padding: 3rem;
-  text-align: center;
-  color: var(--text-secondary);
-}
-
-.empty-state h3 {
-  margin: 1rem 0 0.5rem;
-  color: var(--text-primary);
-}
-
-.empty-state p {
-  margin: 0;
-}
-
-/* Responsive */
-@media (max-width: 600px) {
-  .funnel-item {
-    flex-direction: column;
-    align-items: flex-start;
-  }
-
-  .funnel-stats {
-    gap: 1rem;
-  }
-}
-
diff --git a/client/src/pages/MarketingFunnels.jsx b/client/src/pages/MarketingFunnels.jsx
deleted file mode 100644
index c616f49..0000000
--- a/client/src/pages/MarketingFunnels.jsx
+++ /dev/null
@@ -1,528 +0,0 @@
-import { useState, useEffect } from 'react';
-import { 
-  List, 
-  GitMerge, 
-  Users,
-  Filter,
-  ArrowDown,
-  Plus,
-  ChevronDown,
-  ChevronUp,
-  UserPlus,
-  Check,
-  X
-} from 'lucide-react';
-import { clientSourcesAPI, clientsAPI } from '../services/api';
-import { useModal } from '../components/Modal';
-import './MarketingFunnels.css';
-
-function MarketingFunnels() {
-  const modal = useModal();
-  const [viewMode, setViewMode] = useState('list'); // 'list' or 'chart'
-  const [stats, setStats] = useState({ sources: [], noSourceCount: 0, clients: [] });
-  const [loading, setLoading] = useState(true);
-  const [expandedSources, setExpandedSources] = useState({});
-  const [showNewSourceInput, setShowNewSourceInput] = useState(false);
-  const [newSourceName, setNewSourceName] = useState('');
-  const [newSourceIsGlobal, setNewSourceIsGlobal] = useState(false);
-  const [editingClient, setEditingClient] = useState(null);
-  const [selectedSourceId, setSelectedSourceId] = useState('');
-  const [subSourceValue, setSubSourceValue] = useState('');
-
-  useEffect(() => {
-    loadStats();
-  }, []);
-
-  const loadStats = async () => {
-    try {
-      setLoading(true);
-      const data = await clientSourcesAPI.getStats();
-      setStats(data);
-    } catch (error) {
-      console.error('Failed to load marketing funnel stats:', error);
-    } finally {
-      setLoading(false);
-    }
-  };
-
-  const handleCreateSource = async () => {
-    if (!newSourceName.trim()) return;
-    try {
-      await clientSourcesAPI.create({ 
-        name: newSourceName,
-        is_global: newSourceIsGlobal 
-      });
-      setNewSourceName('');
-      setNewSourceIsGlobal(false);
-      setShowNewSourceInput(false);
-      loadStats(); // Reload to get updated list
-    } catch (error) {
-      console.error('Failed to create source:', error);
-      alert('שגיאה ביצירת מקור');
-    }
-  };
-
-  const toggleSourceExpanded = (sourceId) => {
-    setExpandedSources(prev => ({
-      ...prev,
-      [sourceId]: !prev[sourceId]
-    }));
-  };
-
-  const startEditingSource = (client) => {
-    setEditingClient(client.id);
-    setSelectedSourceId(client.source_id || '');
-    setSubSourceValue(client.sub_source || '');
-  };
-
-  const cancelEditingSource = () => {
-    setEditingClient(null);
-    setSelectedSourceId('');
-    setSubSourceValue('');
-  };
-
-  const handleSourceChange = (sourceId) => {
-    setSelectedSourceId(sourceId);
-    // Clear sub_source if not "הפניות"
-    const selectedSource = stats.sources?.find(s => s.id === sourceId);
-    if (selectedSource?.name !== 'הפניות') {
-      setSubSourceValue('');
-    }
-  };
-
-  const isReferralSource = () => {
-    const selectedSource = stats.sources?.find(s => s.id === selectedSourceId);
-    return selectedSource?.name === 'הפניות';
-  };
-
-  const saveClientSource = async (clientId) => {
-    try {
-      const updateData = {
-        source_id: selectedSourceId || null,
-        sub_source: isReferralSource() ? (subSourceValue || null) : null
-      };
-      await clientsAPI.update(clientId, updateData);
-      modal.success('מקור ההגעה עודכן בהצלחה');
-      cancelEditingSource();
-      loadStats();
-    } catch (error) {
-      console.error('Failed to update source:', error);
-      modal.error('שגיאה בעדכון מקור ההגעה');
-    }
-  };
-
-  const handleAssignSourceToWorkspace = async (sourceId, sourceName) => {
-    if (!confirm(`לשייך את המקור "${sourceName}" ל-workspace שלך?`)) return;
-    try {
-      await clientSourcesAPI.assignToWorkspace(sourceId);
-      modal.success('המקור שויך בהצלחה');
-      loadStats();
-    } catch (error) {
-      console.error('Failed to assign source:', error);
-      modal.error('שגיאה בשיוך המקור');
-    }
-  };
-
-  const getSourceDisplayName = (client) => {
-    const source = stats.sources?.find(s => s.id === client.source_id);
-    if (!source) return null;
-    if (source.name === 'הפניות' && client.sub_source) {
-      return `${source.name} (${client.sub_source})`;
-    }
-    return source.name;
-  };
-
-  const totalClients = stats.clients?.length || 0;
-  const sourcesWithClients = stats.sources?.filter(s => s.client_count > 0) || [];
-
-  // Get clients for a specific source
-  const getClientsForSource = (sourceId) => {
-    return stats.clients?.filter(c => c.source_id === sourceId) || [];
-  };
-
-  // Get clients without source
-  const getClientsWithoutSource = () => {
-    return stats.clients?.filter(c => !c.source_id) || [];
-  };
-
-  if (loading) {
-    return (
-      <div className="page fade-in marketing-funnels-page">
-        <div className="page-header">
-          <div>
-            <h1 className="page-title">משפכים שיווקיים</h1>
-            <p className="page-subtitle">טוען...</p>
-          </div>
-        </div>
-      </div>
-    );
-  }
-
-  return (
-    <div className="page fade-in marketing-funnels-page">
-      <div className="page-header">
-        <div>
-          <h1 className="page-title">משפכים שיווקיים</h1>
-          <p className="page-subtitle">ניהול ומעקב אחר מקורות הגעה של לקוחות</p>
-        </div>
-        
-        <div className="header-actions">
-          {!showNewSourceInput ? (
-            <button 
-              className="btn btn-primary"
-              onClick={() => setShowNewSourceInput(true)}
-            >
-              <Plus size={18} />
-              <span>הוסף מקור חדש</span>
-            </button>
-          ) : (
-            <div className="new-source-input" style={{ display: 'flex', gap: '8px', alignItems: 'center' }}>
-              <input
-                type="text"
-                className="form-input"
-                placeholder="שם המקור החדש..."
-                value={newSourceName}
-                onChange={(e) => setNewSourceName(e.target.value)}
-                onKeyDown={(e) => e.key === 'Enter' && handleCreateSource()}
-                autoFocus
-              />
-              <label style={{ display: 'flex', alignItems: 'center', gap: '4px', whiteSpace: 'nowrap', fontSize: '0.875rem' }}>
-                <input
-                  type="checkbox"
-                  checked={newSourceIsGlobal}
-                  onChange={(e) => setNewSourceIsGlobal(e.target.checked)}
-                />
-                <span>גלובלי</span>
-              </label>
-              <button
-                className="btn btn-primary btn-sm"
-                onClick={handleCreateSource}
-              >
-                הוסף
-              </button>
-              <button
-                className="btn btn-ghost btn-sm"
-                onClick={() => {
-                  setShowNewSourceInput(false);
-                  setNewSourceIsGlobal(false);
-                }}
-              >
-                ביטול
-              </button>
-            </div>
-          )}
-          
-          <div className="view-toggle">
-            <button 
-              className={`view-toggle-btn ${viewMode === 'list' ? 'active' : ''}`}
-              onClick={() => setViewMode('list')}
-              title="תצוגת רשימה"
-            >
-              <List size={18} />
-              <span>רשימה</span>
-            </button>
-            <button 
-              className={`view-toggle-btn ${viewMode === 'chart' ? 'active' : ''}`}
-              onClick={() => setViewMode('chart')}
-              title="תצוגת תרשים"
-            >
-              <GitMerge size={18} />
-              <span>תרשים</span>
-            </button>
-          </div>
-        </div>
-      </div>
-
-      {viewMode === 'list' ? (
-        <div className="funnels-list">
-          {stats.sources?.length === 0 && (
-            <div className="empty-state">
-              <Users size={48} />
-              <h3>אין מקורות הגעה</h3>
-              <p>הוסף מקור הגעה חדש כדי לעקוב אחר לקוחות</p>
-            </div>
-          )}
-          
-          {stats.sources?.map((source) => {
-            const sourceClients = getClientsForSource(source.id);
-            const isExpanded = expandedSources[source.id];
-            
-            return (
-              <div key={source.id} className="funnel-item-wrapper">
-                <div 
-                  className={`funnel-item ${sourceClients.length > 0 ? 'clickable' : ''}`}
-                  onClick={() => sourceClients.length > 0 && toggleSourceExpanded(source.id)}
-                >
-                  <div className="funnel-info">
-                    <div className="funnel-icon">
-                      <Users size={20} />
-                    </div>
-                    <div className="funnel-details">
-                      <h3>
-                        {source.name}
-                        {!source.workspace_id && (
-                          <>
-                            <span 
-                              className="global-badge" 
-                              title="מקור גלובלי - לא משויך ל-workspace"
-                              style={{
-                                marginRight: '8px',
-                                fontSize: '0.7rem',
-                                padding: '2px 6px',
-                                borderRadius: '4px',
-                                background: 'var(--accent-primary)',
-                                color: 'white',
-                                fontWeight: 'normal'
-                              }}
-                            >
-                              גלובלי
-                            </span>
-                            <button
-                              onClick={(e) => {
-                                e.stopPropagation();
-                                handleAssignSourceToWorkspace(source.id, source.name);
-                              }}
-                              className="btn btn-sm btn-ghost"
-                              style={{
-                                marginRight: '8px',
-                                fontSize: '0.75rem',
-                                padding: '2px 8px',
-                                height: 'auto'
-                              }}
-                              title="שייך מקור זה ל-workspace שלי"
-                            >
-                              שייך אלי
-                            </button>
-                          </>
-                        )}
-                      </h3>
-                    </div>
-                  </div>
-                  
-                  <div className="funnel-stats">
-                    <div className="stat-box">
-                      <span className="stat-value">{source.client_count}</span>
-                      <span className="stat-label">לקוחות</span>
-                    </div>
-                    {sourceClients.length > 0 && (
-                      <div className="expand-icon">
-                        {isExpanded ? <ChevronUp size={20} /> : <ChevronDown size={20} />}
-                      </div>
-                    )}
-                  </div>
-                </div>
-                
-                {isExpanded && sourceClients.length > 0 && (
-                  <div className="source-clients-list">
-                    {sourceClients.map(client => (
-                      <div key={client.id} className="source-client-item">
-                        <span className="client-name">{client.name}</span>
-                        
-                        {editingClient === client.id ? (
-                          <div className="source-edit-container">
-                            <select
-                              className="form-input source-select"
-                              value={selectedSourceId}
-                              onChange={(e) => handleSourceChange(e.target.value)}
-                            >
-                              <option value="">ללא מקור</option>
-                              {stats.sources?.map(s => (
-                                <option key={s.id} value={s.id}>{s.name}</option>
-                              ))}
-                            </select>
-                            
-                            {isReferralSource() && (
-                              <input
-                                type="text"
-                                className="form-input sub-source-input"
-                                placeholder="מי הפנה?"
-                                value={subSourceValue}
-                                onChange={(e) => setSubSourceValue(e.target.value)}
-                                onKeyDown={(e) => {
-                                  if (e.key === 'Enter') saveClientSource(client.id);
-                                  if (e.key === 'Escape') cancelEditingSource();
-                                }}
-                              />
-                            )}
-                            
-                            <button
-                              className="btn btn-icon btn-sm btn-success"
-                              onClick={() => saveClientSource(client.id)}
-                              title="שמור"
-                            >
-                              <Check size={14} />
-                            </button>
-                            <button
-                              className="btn btn-icon btn-sm btn-ghost"
-                              onClick={cancelEditingSource}
-                              title="בטל"
-                            >
-                              <X size={14} />
-                            </button>
-                          </div>
-                        ) : (
-                          <button
-                            className="sub-source-btn has-value"
-                            onClick={() => startEditingSource(client)}
-                            title="שינוי מקור הגעה"
-                          >
-                            <UserPlus size={14} />
-                            <span>{getSourceDisplayName(client) || 'שנה מקור'}</span>
-                          </button>
-                        )}
-                        
-                        <span className="client-date">
-                          {new Date(client.created_at).toLocaleDateString('he-IL')}
-                        </span>
-                      </div>
-                    ))}
-                  </div>
-                )}
-              </div>
-            );
-          })}
-          
-          {/* Show clients without source */}
-          {stats.noSourceCount > 0 && (
-            <div className="funnel-item-wrapper">
-              <div 
-                className="funnel-item clickable no-source"
-                onClick={() => toggleSourceExpanded('no-source')}
-              >
-                <div className="funnel-info">
-                  <div className="funnel-icon">
-                    <Users size={20} />
-                  </div>
-                  <div className="funnel-details">
-                    <h3>ללא מקור</h3>
-                  </div>
-                </div>
-                
-                <div className="funnel-stats">
-                  <div className="stat-box">
-                    <span className="stat-value">{stats.noSourceCount}</span>
-                    <span className="stat-label">לקוחות</span>
-                  </div>
-                  <div className="expand-icon">
-                    {expandedSources['no-source'] ? <ChevronUp size={20} /> : <ChevronDown size={20} />}
-                  </div>
-                </div>
-              </div>
-              
-              {expandedSources['no-source'] && (
-                <div className="source-clients-list">
-                  {getClientsWithoutSource().map(client => (
-                    <div key={client.id} className="source-client-item">
-                      <span className="client-name">{client.name}</span>
-                      
-                      {editingClient === client.id ? (
-                        <div className="source-edit-container">
-                          <select
-                            className="form-input source-select"
-                            value={selectedSourceId}
-                            onChange={(e) => handleSourceChange(e.target.value)}
-                            autoFocus
-                          >
-                            <option value="">ללא מקור</option>
-                            {stats.sources?.map(s => (
-                              <option key={s.id} value={s.id}>{s.name}</option>
-                            ))}
-                          </select>
-                          
-                          {isReferralSource() && (
-                            <input
-                              type="text"
-                              className="form-input sub-source-input"
-                              placeholder="מי הפנה?"
-                              value={subSourceValue}
-                              onChange={(e) => setSubSourceValue(e.target.value)}
-                              onKeyDown={(e) => {
-                                if (e.key === 'Enter') saveClientSource(client.id);
-                                if (e.key === 'Escape') cancelEditingSource();
-                              }}
-                            />
-                          )}
-                          
-                          <button
-                            className="btn btn-icon btn-sm btn-success"
-                            onClick={() => saveClientSource(client.id)}
-                            title="שמור"
-                          >
-                            <Check size={14} />
-                          </button>
-                          <button
-                            className="btn btn-icon btn-sm btn-ghost"
-                            onClick={cancelEditingSource}
-                            title="בטל"
-                          >
-                            <X size={14} />
-                          </button>
-                        </div>
-                      ) : (
-                        <button
-                          className="sub-source-btn"
-                          onClick={() => startEditingSource(client)}
-                          title="הוספת מקור הגעה"
-                        >
-                          <UserPlus size={14} />
-                          <span>הוסף מקור</span>
-                        </button>
-                      )}
-                      
-                      <span className="client-date">
-                        {new Date(client.created_at).toLocaleDateString('he-IL')}
-                      </span>
-                    </div>
-                  ))}
-                </div>
-              )}
-            </div>
-          )}
-        </div>
-      ) : (
-        <div className="funnel-chart-container">
-          <div className="chart-sources">
-            {sourcesWithClients.map((source) => (
-              <div key={source.id} className="chart-node source-node">
-                <div className="chart-node-icon">
-                  <Users size={20} />
-                </div>
-                <div className="chart-node-title">{source.name}</div>
-                <div className="chart-node-value">{source.client_count} לקוחות</div>
-                <div className="flow-arrow-indicator">
-                  <ArrowDown size={16} className="text-gray-300 mt-2" />
-                </div>
-              </div>
-            ))}
-            
-            {stats.noSourceCount > 0 && (
-              <div className="chart-node source-node no-source">
-                <div className="chart-node-icon">
-                  <Users size={20} />
-                </div>
-                <div className="chart-node-title">ללא מקור</div>
-                <div className="chart-node-value">{stats.noSourceCount} לקוחות</div>
-                <div className="flow-arrow-indicator">
-                  <ArrowDown size={16} className="text-gray-300 mt-2" />
-                </div>
-              </div>
-            )}
-          </div>
-
-          <div className="merge-point"></div>
-
-          <div className="chart-node target-node">
-            <div className="chart-node-icon">
-              <Filter size={24} />
-            </div>
-            <div className="chart-node-title">סך הכל לקוחות</div>
-            <div className="chart-node-value text-xl">{totalClients}</div>
-          </div>
-        </div>
-      )}
-    </div>
-  );
-}
-
-export default MarketingFunnels;
-
diff --git a/client/src/pages/Profile.jsx b/client/src/pages/Profile.jsx
index e7da925..210b3f9 100644
--- a/client/src/pages/Profile.jsx
+++ b/client/src/pages/Profile.jsx
@@ -1,4 +1,4 @@
-import { useState } from 'react';
+import { useState, useId } from 'react';
 import { createPortal } from 'react-dom';
 import { useNavigate } from 'react-router-dom';
 import { Save, Trash2, AlertTriangle } from 'lucide-react';
@@ -12,6 +12,7 @@ function Profile() {
   const { user, updateUser, logout } = useStore();
   const navigate = useNavigate();
   const modal = useModal();
+  const uid = useId();
   
   const [formData, setFormData] = useState({
     name: user?.name || '',
@@ -23,7 +24,9 @@ function Profile() {
   const [loading, setLoading] = useState(false);
   const [message, setMessage] = useState({ type: '', text: '' });
   const [showDeleteModal, setShowDeleteModal] = useState(false);
-  const [deletePassword, setDeletePassword] = useState('');
+  // The password - or, for a passkey-only account (no password to type), the account's email
+  const [deleteConfirmation, setDeleteConfirmation] = useState('');
+  const passkeyOnly = user?.has_password === 0;
   
   // Lock body scroll when delete modal is open
   useBodyScrollLock(showDeleteModal);
@@ -56,11 +59,14 @@ function Profile() {
       };
       
       if (formData.password) {
-        updateData.currentPassword = formData.currentPassword;
+        // A passkey-only account sets its first password - it has no current one
+        if (!passkeyOnly) updateData.currentPassword = formData.currentPassword;
         updateData.password = formData.password;
       }
       
-      const updatedUser = await authAPI.updateProfile(updateData);
+      // A new password signs out the other sessions; this one continues with the fresh token
+      const { token, ...updatedUser } = await authAPI.updateProfile(updateData);
+      if (token) localStorage.setItem('token', token);
       updateUser(updatedUser);
       
       modal.success('הפרופיל עודכן בהצלחה');
@@ -78,13 +84,13 @@ function Profile() {
   };
   
   const handleDeleteAccount = async () => {
-    if (!deletePassword) {
-      modal.warning('נא להזין סיסמה');
+    if (!deleteConfirmation) {
+      modal.warning(passkeyOnly ? 'נא להקליד את כתובת האימייל' : 'נא להזין סיסמה');
       return;
     }
     
     try {
-      await authAPI.deleteAccount(deletePassword);
+      await authAPI.deleteAccount(passkeyOnly ? { confirmEmail: deleteConfirmation.trim() } : { password: deleteConfirmation });
       logout();
       navigate('/login');
     } catch (error) {
@@ -111,8 +117,9 @@ function Profile() {
             <h3 className="form-section-title">פרטים אישיים</h3>
             
             <div className="form-group">
-              <label className="form-label">שם מלא</label>
+              <label className="form-label" htmlFor={`${uid}-name`}>שם מלא</label>
               <input
+                id={`${uid}-name`}
                 type="text"
                 name="name"
                 className="form-input"
@@ -123,8 +130,9 @@ function Profile() {
             </div>
             
             <div className="form-group">
-              <label className="form-label">אימייל</label>
+              <label className="form-label" htmlFor={`${uid}-email`}>אימייל</label>
               <input
+                id={`${uid}-email`}
                 type="email"
                 name="email"
                 className="form-input"
@@ -137,11 +145,13 @@ function Profile() {
           </div>
           
           <div className="form-section">
-            <h3 className="form-section-title">שינוי סיסמה</h3>
+            <h3 className="form-section-title">{passkeyOnly ? 'הגדרת סיסמה' : 'שינוי סיסמה'}</h3>
             
+            {!passkeyOnly && (
             <div className="form-group">
-              <label className="form-label">סיסמה נוכחית</label>
+              <label className="form-label" htmlFor={`${uid}-currentPassword`}>סיסמה נוכחית</label>
               <input
+                id={`${uid}-currentPassword`}
                 type="password"
                 name="currentPassword"
                 className="form-input"
@@ -150,10 +160,12 @@ function Profile() {
                 dir="ltr"
               />
             </div>
+            )}
             
             <div className="form-group">
-              <label className="form-label">סיסמה חדשה</label>
+              <label className="form-label" htmlFor={`${uid}-password`}>סיסמה חדשה</label>
               <input
+                id={`${uid}-password`}
                 type="password"
                 name="password"
                 className="form-input"
@@ -165,8 +177,9 @@ function Profile() {
             </div>
             
             <div className="form-group">
-              <label className="form-label">אימות סיסמה חדשה</label>
+              <label className="form-label" htmlFor={`${uid}-confirmPassword`}>אימות סיסמה חדשה</label>
               <input
+                id={`${uid}-confirmPassword`}
                 type="password"
                 name="confirmPassword"
                 className="form-input"
@@ -208,16 +221,33 @@ function Profile() {
                 <p>פעולה זו היא בלתי הפיכה. כל הלקוחות, הפרויקטים, המשימות ורשומות הזמן שלך יימחקו לצמיתות.</p>
               </div>
               
-              <div className="form-group">
-                <label className="form-label">הזן את הסיסמה שלך לאישור</label>
-                <input
-                  type="password"
-                  className="form-input"
-                  value={deletePassword}
-                  onChange={e => setDeletePassword(e.target.value)}
-                  dir="ltr"
-                />
-              </div>
+              {passkeyOnly ? (
+                <div className="form-group">
+                  <label className="form-label" htmlFor={`${uid}-delete-email`}>הקלידו את האימייל שלכם לאישור</label>
+                  <input
+                    id={`${uid}-delete-email`}
+                    type="email"
+                    autoComplete="off"
+                    className="form-input"
+                    value={deleteConfirmation}
+                    onChange={e => setDeleteConfirmation(e.target.value)}
+                    placeholder={user?.email}
+                    dir="ltr"
+                  />
+                </div>
+              ) : (
+                <div className="form-group">
+                  <label className="form-label" htmlFor={`${uid}-delete-password`}>הזן את הסיסמה שלך לאישור</label>
+                  <input
+                    id={`${uid}-delete-password`}
+                    type="password"
+                    className="form-input"
+                    value={deleteConfirmation}
+                    onChange={e => setDeleteConfirmation(e.target.value)}
+                    dir="ltr"
+                  />
+                </div>
+              )}
             </div>
             <div className="modal-footer">
               <button onClick={handleDeleteAccount} className="btn btn-danger">
diff --git a/client/src/pages/Profile.test.jsx b/client/src/pages/Profile.test.jsx
new file mode 100644
index 0000000..cdc10ae
--- /dev/null
+++ b/client/src/pages/Profile.test.jsx
@@ -0,0 +1,155 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { MemoryRouter, Routes, Route } from 'react-router-dom';
+
+const apiMocks = vi.hoisted(() => ({
+  authAPI: { deleteAccount: vi.fn(), updateProfile: vi.fn() }
+}));
+vi.mock('../services/api', () => apiMocks);
+
+import Profile from './Profile';
+import useStore from '../store/useStore';
+import { ModalProvider } from '../components/Modal';
+
+const { authAPI } = apiMocks;
+const initialState = useStore.getState();
+
+const renderProfile = (user) => {
+  useStore.setState({ user, isAuthenticated: true });
+  const ui = userEvent.setup();
+  render(
+    <ModalProvider>
+      <MemoryRouter initialEntries={['/profile']}>
+        <Routes>
+          <Route path="/profile" element={<Profile />} />
+          <Route path="/login" element={<p>עמוד התחברות</p>} />
+        </Routes>
+      </MemoryRouter>
+    </ModalProvider>
+  );
+  return ui;
+};
+
+const openDeleteDialog = (ui) => ui.click(screen.getByRole('button', { name: 'מחק את החשבון' }));
+const confirmDelete = (ui) => ui.click(screen.getByRole('button', { name: 'מחק את החשבון לצמיתות' }));
+
+beforeEach(() => {
+  useStore.setState(initialState, true);
+  authAPI.deleteAccount.mockReset();
+  authAPI.deleteAccount.mockResolvedValue({ message: 'החשבון נמחק בהצלחה' });
+  authAPI.updateProfile.mockReset();
+});
+
+const savedUser = (extra = {}) => ({ id: 'u1', name: 'דנה', email: 'dana@example.com', default_hourly_rate: 250, has_password: 1, ...extra });
+
+describe('Profile - password', () => {
+  it('changes the password with the current one and keeps this session with the fresh token', async () => {
+    localStorage.setItem('token', 'old-session');
+    authAPI.updateProfile.mockResolvedValue({ ...savedUser(), token: 'fresh-session' });
+    const ui = renderProfile({ id: 'u1', name: 'דנה', email: 'dana@example.com', has_password: 1 });
+
+    expect(screen.getByRole('heading', { name: 'שינוי סיסמה' })).toBeInTheDocument();
+    await ui.type(screen.getByLabelText('סיסמה נוכחית'), 'old-pass');
+    await ui.type(screen.getByLabelText('סיסמה חדשה'), 'new-pass1');
+    await ui.type(screen.getByLabelText('אימות סיסמה חדשה'), 'new-pass1');
+    await ui.click(screen.getByRole('button', { name: 'שמור שינויים' }));
+
+    expect(await screen.findByText('הפרופיל עודכן בהצלחה')).toBeInTheDocument();
+    expect(authAPI.updateProfile).toHaveBeenCalledWith({
+      name: 'דנה', email: 'dana@example.com', currentPassword: 'old-pass', password: 'new-pass1'
+    });
+    expect(localStorage.getItem('token')).toBe('fresh-session');
+    expect(useStore.getState().user).not.toHaveProperty('token');
+    expect(useStore.getState().isAuthenticated).toBe(true);
+  });
+
+  it('keeps the stored token when the response has none (no password change)', async () => {
+    localStorage.setItem('token', 'old-session');
+    authAPI.updateProfile.mockResolvedValue(savedUser({ name: 'דנה כהן' }));
+    const ui = renderProfile({ id: 'u1', name: 'דנה', email: 'dana@example.com', has_password: 1 });
+
+    await ui.clear(screen.getByLabelText('שם מלא'));
+    await ui.type(screen.getByLabelText('שם מלא'), 'דנה כהן');
+    await ui.click(screen.getByRole('button', { name: 'שמור שינויים' }));
+
+    expect(await screen.findByText('הפרופיל עודכן בהצלחה')).toBeInTheDocument();
+    expect(localStorage.getItem('token')).toBe('old-session');
+    expect(useStore.getState().user.name).toBe('דנה כהן');
+  });
+
+  it('a passkey-only account sets a first password without a current one', async () => {
+    authAPI.updateProfile.mockResolvedValue({ ...savedUser(), token: 'fresh-session' });
+    const ui = renderProfile({ id: 'u1', name: 'דנה', email: 'dana@example.com', has_password: 0 });
+
+    expect(screen.getByRole('heading', { name: 'הגדרת סיסמה' })).toBeInTheDocument();
+    expect(screen.queryByLabelText('סיסמה נוכחית')).not.toBeInTheDocument();
+    await ui.type(screen.getByLabelText('סיסמה חדשה'), 'first-pass');
+    await ui.type(screen.getByLabelText('אימות סיסמה חדשה'), 'first-pass');
+    await ui.click(screen.getByRole('button', { name: 'שמור שינויים' }));
+
+    expect(await screen.findByText('הפרופיל עודכן בהצלחה')).toBeInTheDocument();
+    expect(authAPI.updateProfile).toHaveBeenCalledWith({ name: 'דנה', email: 'dana@example.com', password: 'first-pass' });
+    expect(localStorage.getItem('token')).toBe('fresh-session');
+    // The account has a password now: the next change asks for it
+    expect(useStore.getState().user.has_password).toBe(1);
+    expect(screen.getByLabelText('סיסמה נוכחית')).toBeInTheDocument();
+  });
+});
+
+describe('Profile - delete account', () => {
+  it('asks for the password of an account that has one', async () => {
+    const ui = renderProfile({ id: 'u1', name: 'דנה', email: 'dana@example.com', has_password: 1 });
+
+    await openDeleteDialog(ui);
+    expect(screen.queryByLabelText('הקלידו את האימייל שלכם לאישור')).not.toBeInTheDocument();
+    const password = screen.getByLabelText('הזן את הסיסמה שלך לאישור');
+    expect(password).toHaveAttribute('type', 'password');
+
+    await ui.type(password, 'secret');
+    await confirmDelete(ui);
+
+    expect(authAPI.deleteAccount).toHaveBeenCalledWith({ password: 'secret' });
+    expect(await screen.findByText('עמוד התחברות')).toBeInTheDocument();
+    expect(useStore.getState().isAuthenticated).toBe(false);
+  });
+
+  it('treats a user without has_password (e.g. right after registering) as having a password', async () => {
+    const ui = renderProfile({ id: 'u1', name: 'דנה', email: 'dana@example.com' });
+
+    await openDeleteDialog(ui);
+
+    expect(screen.getByLabelText('הזן את הסיסמה שלך לאישור')).toBeInTheDocument();
+  });
+
+  it('a passkey-only account confirms with its email instead of a password', async () => {
+    const ui = renderProfile({ id: 'u1', name: 'דנה', email: 'dana@example.com', has_password: 0 });
+
+    await openDeleteDialog(ui);
+    expect(screen.queryByLabelText('הזן את הסיסמה שלך לאישור')).not.toBeInTheDocument();
+    const email = screen.getByLabelText('הקלידו את האימייל שלכם לאישור');
+    expect(email).toHaveAttribute('type', 'email');
+
+    await ui.type(email, ' dana@example.com ');
+    await confirmDelete(ui);
+
+    expect(authAPI.deleteAccount).toHaveBeenCalledWith({ confirmEmail: 'dana@example.com' });
+    expect(await screen.findByText('עמוד התחברות')).toBeInTheDocument();
+  });
+
+  it('does not call the server with an empty confirmation, and shows a server refusal', async () => {
+    authAPI.deleteAccount.mockRejectedValue(new Error('כתובת האימייל אינה תואמת לחשבון'));
+    const ui = renderProfile({ id: 'u1', name: 'דנה', email: 'dana@example.com', has_password: 0 });
+
+    await openDeleteDialog(ui);
+    await confirmDelete(ui);
+    expect(await screen.findByText('נא להקליד את כתובת האימייל')).toBeInTheDocument();
+    expect(authAPI.deleteAccount).not.toHaveBeenCalled();
+    await ui.click(screen.getByRole('button', { name: 'אישור' }));
+
+    await ui.type(screen.getByLabelText('הקלידו את האימייל שלכם לאישור'), 'other@example.com');
+    await confirmDelete(ui);
+    expect(await screen.findByText('כתובת האימייל אינה תואמת לחשבון')).toBeInTheDocument();
+    expect(useStore.getState().isAuthenticated).toBe(true);
+  });
+});
diff --git a/client/src/pages/ProjectDetail.jsx b/client/src/pages/ProjectDetail.jsx
index a8907ff..5ec592b 100644
--- a/client/src/pages/ProjectDetail.jsx
+++ b/client/src/pages/ProjectDetail.jsx
@@ -1,4 +1,4 @@
-import { useState, useEffect, useCallback } from 'react';
+import { useState, useEffect, useCallback, useId } from 'react';
 import { createPortal } from 'react-dom';
 import { useParams, Link, useNavigate, useOutletContext, useSearchParams } from 'react-router-dom';
 import { Plus, Play, Pause, Square, X, Edit2, Trash2, Clock, CheckSquare, Bell, DollarSign, CreditCard, AlertCircle, AlertTriangle, CheckCircle2, MessageSquare, Folder, TrendingUp, Share2, Globe, Mail, Phone, Key, FileText, StickyNote, Circle, CircleCheck, ChevronDown, ChevronUp, Copy, ChevronLeft, ListTodo } from 'lucide-react';
@@ -38,6 +38,7 @@ function ProjectDetail() {
   const [searchParams] = useSearchParams();
   const { setStats: setGlobalStats } = useOutletContext();
   const modal = useModal();
+  const uid = useId();
   const { activeTimers, startTimer, pauseTimer, resumeTimer, stopTimer, discardTimer, getTimerForProject, integrations, isAddonEnabled } = useStore();
 
   // Get initial tab from URL param or default to 'tasks'
@@ -1497,8 +1498,9 @@ function ProjectDetail() {
               </div>
 
               <div className="form-group">
-                <label className="form-label">הערות (אופציונלי)</label>
+                <label className="form-label" htmlFor={`${uid}-stop-notes`}>הערות (אופציונלי)</label>
                 <textarea
+                  id={`${uid}-stop-notes`}
                   className="form-input"
                   value={stopNotes}
                   onChange={e => setStopNotes(e.target.value)}
diff --git a/client/src/pages/Projects.jsx b/client/src/pages/Projects.jsx
index 6fa5ff4..abebf65 100644
--- a/client/src/pages/Projects.jsx
+++ b/client/src/pages/Projects.jsx
@@ -1,4 +1,4 @@
-import { useState, useEffect } from 'react';
+import { useState, useEffect, useId } from 'react';
 import { createPortal } from 'react-dom';
 import { Link } from 'react-router-dom';
 import { Plus, Search, Edit2, Trash2, Play, Pause, Square, Folder } from 'lucide-react';
@@ -14,6 +14,7 @@ import './Projects.css';
 function Projects() {
     const { activeTimers, startTimer, pauseTimer, resumeTimer, stopTimer, getTimerForProject } = useStore();
     const modal = useModal();
+    const uid = useId();
     const [projects, setProjects] = useState([]);
     const [loading, setLoading] = useState(true);
     const [showModal, setShowModal] = useState(false);
@@ -365,8 +366,9 @@ function Projects() {
                             </div>
                             
                             <div className="form-group">
-                                <label className="form-label">הערות (אופציונלי)</label>
+                                <label className="form-label" htmlFor={`${uid}-stop-notes`}>הערות (אופציונלי)</label>
                                 <textarea 
+                                    id={`${uid}-stop-notes`}
                                     className="form-input"
                                     value={stopNotes}
                                     onChange={e => setStopNotes(e.target.value)}
diff --git a/client/src/pages/Schedule.jsx b/client/src/pages/Schedule.jsx
index 91efdaa..4ccfc8e 100644
--- a/client/src/pages/Schedule.jsx
+++ b/client/src/pages/Schedule.jsx
@@ -1,4 +1,4 @@
-import { useState, useEffect, useMemo, useCallback, useRef } from 'react';
+import { useState, useEffect, useMemo, useCallback, useRef, useId } from 'react';
 import { Link, useNavigate } from 'react-router-dom';
 import { Calendar as CalendarIcon, ChevronLeft, ChevronRight, ChevronUp, ChevronDown, Clock, Plus, X, Trash2, GripVertical, Repeat, ListTodo, Timer, Bell, UserPlus } from 'lucide-react';
 import { timerAPI, clientsAPI, projectsAPI, plannedSlotsAPI, leadsAPI, remindersAPI } from '../services/api';
@@ -175,6 +175,7 @@ function computeTimeGridLayout(entries, hourHeight = HOUR_HEIGHT) {
 function Schedule() {
   const navigate = useNavigate();
   const modal = useModal();
+  const uid = useId();
   const [view, setView] = useState('month');
   const [currentDate, setCurrentDate] = useState(new Date());
   const [entries, setEntries] = useState([]);
@@ -1257,8 +1258,9 @@ function Schedule() {
             {slotForm.slot_type === 'client' ? (
               <>
                 <div className="slot-field">
-                  <label>לקוח *</label>
+                  <label htmlFor={`${uid}-client`}>לקוח *</label>
                   <select
+                    id={`${uid}-client`}
                     value={slotForm.client_id}
                     onChange={e => handleClientChange(e.target.value)}
                   >
@@ -1270,8 +1272,9 @@ function Schedule() {
                 </div>
 
                 <div className="slot-field">
-                  <label>פרויקט (אופציונלי)</label>
+                  <label htmlFor={`${uid}-project`}>פרויקט (אופציונלי)</label>
                   <select
+                    id={`${uid}-project`}
                     value={slotForm.project_id}
                     onChange={e => setSlotForm(prev => ({ ...prev, project_id: e.target.value }))}
                     disabled={!slotForm.client_id}
@@ -1285,8 +1288,9 @@ function Schedule() {
               </>
             ) : (
               <div className="slot-field">
-                <label>ליד *</label>
+                <label htmlFor={`${uid}-lead`}>ליד *</label>
                 <select
+                  id={`${uid}-lead`}
                   value={slotForm.lead_id}
                   onChange={e => setSlotForm(prev => ({ ...prev, lead_id: e.target.value }))}
                 >
@@ -1299,8 +1303,8 @@ function Schedule() {
             )}
 
             <div className="slot-field">
-              <label>משך זמן *</label>
-              <div className="duration-inputs">
+              <label id={`${uid}-duration-label`}>משך זמן *</label>
+              <div className="duration-inputs" role="group" aria-labelledby={`${uid}-duration-label`}>
                 <div className="duration-input-group">
                   <input
                     type="number"
@@ -1326,8 +1330,9 @@ function Schedule() {
             </div>
 
             <div className="slot-field">
-              <label>הערות</label>
+              <label htmlFor={`${uid}-notes`}>הערות</label>
               <textarea
+                id={`${uid}-notes`}
                 value={slotForm.notes}
                 onChange={e => setSlotForm(prev => ({ ...prev, notes: e.target.value }))}
                 placeholder="הערות לתכנון..."
diff --git a/client/src/pages/SettingsPage.jsx b/client/src/pages/SettingsPage.jsx
index 1afad32..fb40f90 100644
--- a/client/src/pages/SettingsPage.jsx
+++ b/client/src/pages/SettingsPage.jsx
@@ -1,4 +1,4 @@
-import { useState, useEffect } from 'react';
+import { useState, useEffect, useId } from 'react';
 import { Check, Key, Plug, Puzzle, Settings, Save, FileText, StickyNote, Info, X, Filter, Target, Bell, Package, Sparkles, Eye, EyeOff, ShieldCheck } from 'lucide-react';
 import PasskeysManager from '../components/PasskeysManager';
 import api, { addonsAPI, authAPI } from '../services/api';
@@ -21,7 +21,10 @@ const ADDON_ICONS = {
 function SettingsPage() {
   const [activeTab, setActiveTab] = useState('integrations');
   const modal = useModal();
-  const { user, updateUser, loadEnabledAddons } = useStore();
+  const uid = useId();
+  const { user, updateUser, loadEnabledAddons, workspaceRole } = useStore();
+  // תוספים והגדרותיהם חלים על כל ה-workspace - רק בעלים או מנהל משנים אותם (השרת אוכף זאת)
+  const canManageAddons = workspaceRole === 'owner' || workspaceRole === 'admin';
 
   // Integrations state
   const [integrations, setIntegrations] = useState([]);
@@ -276,6 +279,12 @@ function SettingsPage() {
                   הערה: כיבוי תוסף לא מוחק את הנתונים שכבר שמרת. אם תפעיל את התוסף מחדש, הנתונים יהיו שם.
                 </span>
               </div>
+              {!canManageAddons && (
+                <div className="addons-info-banner">
+                  <Info size={20} />
+                  <span>רק הבעלים או מנהל ה-workspace יכולים להפעיל, לכבות ולהגדיר תוספים.</span>
+                </div>
+              )}
 
               {loadingAddons ? (
                 <div style={{ padding: '2rem', textAlign: 'center' }}>
@@ -320,7 +329,7 @@ function SettingsPage() {
                           <button
                             className={`addon-toggle ${addon.isEnabled ? 'toggle-on' : 'toggle-off'}`}
                             onClick={() => handleToggleAddon(addon.id, addon.isEnabled)}
-                            disabled={isUpdating}
+                            disabled={isUpdating || !canManageAddons}
                           >
                             <span className="toggle-track">
                               <span className="toggle-thumb">
@@ -364,8 +373,9 @@ function SettingsPage() {
                   <h3 className="settings-section-title">הגדרות תמחור</h3>
                   
                   <div className="form-group">
-                    <label className="form-label">מחיר ברירת מחדל לשעה (₪)</label>
+                    <label className="form-label" htmlFor={`${uid}-default_hourly_rate`}>מחיר ברירת מחדל לשעה (₪)</label>
                     <input
+                      id={`${uid}-default_hourly_rate`}
                       type="number"
                       name="default_hourly_rate"
                       className="form-input"
@@ -426,14 +436,16 @@ function SettingsPage() {
                   {settingsModalAddon.id === 'ai_assistant' && (
                     <>
                       <div className="form-group">
-                        <label className="form-label">OpenAI API Key</label>
+                        <label className="form-label" htmlFor={`${uid}-openai-api-key`}>OpenAI API Key</label>
                         <div className="api-key-input-wrapper">
                           <input
+                            id={`${uid}-openai-api-key`}
                             type={showApiKey ? 'text' : 'password'}
                             className="form-input"
                             value={addonSettings.openai_api_key || ''}
                             onChange={(e) => handleAddonSettingChange('openai_api_key', e.target.value)}
                             placeholder="sk-..."
+                            disabled={!canManageAddons}
                             dir="ltr"
                           />
                           <button
@@ -464,14 +476,16 @@ function SettingsPage() {
               <button className="btn btn-ghost" onClick={closeAddonSettings}>
                 ביטול
               </button>
-              <button 
-                className="btn btn-primary" 
-                onClick={saveAddonSettings}
-                disabled={savingAddonSettings}
-              >
-                <Save size={16} />
-                {savingAddonSettings ? 'שומר...' : 'שמור'}
-              </button>
+              {canManageAddons && (
+                <button 
+                  className="btn btn-primary" 
+                  onClick={saveAddonSettings}
+                  disabled={savingAddonSettings}
+                >
+                  <Save size={16} />
+                  {savingAddonSettings ? 'שומר...' : 'שמור'}
+                </button>
+              )}
             </div>
           </div>
         </div>
diff --git a/client/src/pages/TaskDetail.jsx b/client/src/pages/TaskDetail.jsx
index ecae007..1618992 100644
--- a/client/src/pages/TaskDetail.jsx
+++ b/client/src/pages/TaskDetail.jsx
@@ -1,4 +1,4 @@
-import { useState, useEffect, useCallback } from 'react';
+import { useState, useEffect, useCallback, useId } from 'react';
 import { createPortal } from 'react-dom';
 import { useParams, Link, useNavigate, useOutletContext } from 'react-router-dom';
 import { Plus, Play, Pause, Square, Edit2, Trash2, Clock, Bell, FileText, DollarSign, CreditCard, AlertCircle, CheckCircle2, CheckSquare, TrendingUp, Folder, StickyNote, ListChecks, ChevronDown, ChevronUp } from 'lucide-react';
@@ -31,6 +31,7 @@ function TaskDetail() {
   const outletContext = useOutletContext();
   const setStats = outletContext?.setStats;
   const modal = useModal();
+  const uid = useId();
   const { activeTimers, startTimer, pauseTimer, resumeTimer, stopTimer, getTimerForProject, integrations, isAddonEnabled } = useStore();
 
   const [task, setTask] = useState(null);
@@ -998,8 +999,9 @@ function TaskDetail() {
               <div className="time-range-section">
                 <div className="time-range-row">
                   <div className="form-group">
-                    <label className="form-label">תאריך התחלה</label>
+                    <label className="form-label" htmlFor={`${uid}-stop-start-date`}>תאריך התחלה</label>
                     <input
+                      id={`${uid}-stop-start-date`}
                       type="date"
                       className="form-input"
                       value={stopStartDate}
@@ -1008,8 +1010,9 @@ function TaskDetail() {
                     />
                   </div>
                   <div className="form-group">
-                    <label className="form-label">שעה</label>
+                    <label className="form-label" htmlFor={`${uid}-stop-start-time`}>שעה</label>
                     <input
+                      id={`${uid}-stop-start-time`}
                       type="time"
                       className="form-input"
                       value={stopStartTime}
@@ -1021,8 +1024,9 @@ function TaskDetail() {
 
                 <div className="time-range-row">
                   <div className="form-group">
-                    <label className="form-label">תאריך סיום</label>
+                    <label className="form-label" htmlFor={`${uid}-stop-end-date`}>תאריך סיום</label>
                     <input
+                      id={`${uid}-stop-end-date`}
                       type="date"
                       className="form-input"
                       value={stopEndDate}
@@ -1031,8 +1035,9 @@ function TaskDetail() {
                     />
                   </div>
                   <div className="form-group">
-                    <label className="form-label">שעה</label>
+                    <label className="form-label" htmlFor={`${uid}-stop-end-time`}>שעה</label>
                     <input
+                      id={`${uid}-stop-end-time`}
                       type="time"
                       className="form-input"
                       value={stopEndTime}
@@ -1057,8 +1062,9 @@ function TaskDetail() {
               </div>
 
               <div className="form-group">
-                <label className="form-label">הערות (אופציונלי)</label>
+                <label className="form-label" htmlFor={`${uid}-stop-notes`}>הערות (אופציונלי)</label>
                 <textarea
+                  id={`${uid}-stop-notes`}
                   className="form-input"
                   value={stopNotes}
                   onChange={e => setStopNotes(e.target.value)}
diff --git a/client/src/pages/TimeEntries.jsx b/client/src/pages/TimeEntries.jsx
index 7d8be34..34e5bb4 100644
--- a/client/src/pages/TimeEntries.jsx
+++ b/client/src/pages/TimeEntries.jsx
@@ -1,4 +1,4 @@
-import { Fragment, useState, useEffect } from 'react';
+import { Fragment, useState, useEffect, useId } from 'react';
 import { createPortal } from 'react-dom';
 import { Link } from 'react-router-dom';
 import { Clock, Calendar, Folder, Tag, Search, Filter, Play, Pause, Square, Plus, ChevronDown, ChevronUp } from 'lucide-react';
@@ -67,6 +67,7 @@ function IntervalsDisplay({ entryId }) {
 function TimeEntries() {
   const { activeTimers, startTimer, pauseTimer, resumeTimer, stopTimer, getTimerForProject } = useStore();
   const modal = useModal();
+  const uid = useId();
   const [entries, setEntries] = useState([]);
   const [loading, setLoading] = useState(true);
   const [searchTerm, setSearchTerm] = useState('');
@@ -401,8 +402,9 @@ function TimeEntries() {
               </div>
               
               <div className="form-group">
-                <label className="form-label">הערות (אופציונלי)</label>
+                <label className="form-label" htmlFor={`${uid}-stop-notes`}>הערות (אופציונלי)</label>
                 <textarea 
+                  id={`${uid}-stop-notes`}
                   className="form-input"
                   value={stopNotes}
                   onChange={e => setStopNotes(e.target.value)}
diff --git a/client/src/pages/WorkspaceSettings.jsx b/client/src/pages/WorkspaceSettings.jsx
index 1137cd2..c25afa6 100644
--- a/client/src/pages/WorkspaceSettings.jsx
+++ b/client/src/pages/WorkspaceSettings.jsx
@@ -1,4 +1,4 @@
-import { useState, useEffect } from 'react';
+import { useState, useEffect, useId } from 'react';
 import { useNavigate } from 'react-router-dom';
 import { 
   Building2, Users, Link2, Copy, Check, Trash2, 
@@ -19,12 +19,15 @@ function WorkspaceSettings() {
     leaveWorkspace,
     loadWorkspaces,
     canManageWorkspace,
+    canDeleteWorkspace,
+    canChangeMemberRole,
     canInviteMembers,
     canRemoveMember
   } = useStore();
   
   const navigate = useNavigate();
   const modal = useModal();
+  const uid = useId();
   
   const [activeTab, setActiveTab] = useState('members');
   const [members, setMembers] = useState([]);
@@ -259,7 +262,7 @@ function WorkspaceSettings() {
                           <span>{getRoleLabel(member.role)}</span>
                         </div>
                         <div className="member-actions">
-                          {canManageWorkspace() && member.role !== 'owner' && (
+                          {canChangeMemberRole(member.role) && (
                             <select
                               value={member.role}
                               onChange={(e) => handleUpdateMemberRole(member.user_id, e.target.value)}
@@ -342,9 +345,10 @@ function WorkspaceSettings() {
               {activeTab === 'general' && canManageWorkspace() && (
                 <div className="general-section">
                   <div className="setting-group">
-                    <label>שם ה-Workspace</label>
+                    <label htmlFor={`${uid}-workspace-name`}>שם ה-Workspace</label>
                     <div className="setting-input-row">
                       <input
+                        id={`${uid}-workspace-name`}
                         type="text"
                         value={workspaceName}
                         onChange={(e) => setWorkspaceName(e.target.value)}
@@ -360,6 +364,7 @@ function WorkspaceSettings() {
                     </div>
                   </div>
 
+                  {canDeleteWorkspace() && (
                   <div className="danger-zone">
                     <h3>
                       <AlertTriangle size={18} />
@@ -376,6 +381,7 @@ function WorkspaceSettings() {
                       </button>
                     </div>
                   </div>
+                  )}
                 </div>
               )}
 
diff --git a/client/src/pages/WorkspaceSettings.test.jsx b/client/src/pages/WorkspaceSettings.test.jsx
new file mode 100644
index 0000000..167c32e
--- /dev/null
+++ b/client/src/pages/WorkspaceSettings.test.jsx
@@ -0,0 +1,91 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { render, screen, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { MemoryRouter } from 'react-router-dom';
+
+const apiMocks = vi.hoisted(() => ({
+  workspacesAPI: { getMembers: vi.fn(), getInvites: vi.fn(), update: vi.fn() }
+}));
+vi.mock('../services/api', () => apiMocks);
+
+import WorkspaceSettings from './WorkspaceSettings';
+import useStore from '../store/useStore';
+import { ModalProvider } from '../components/Modal';
+
+const { workspacesAPI } = apiMocks;
+const initialState = useStore.getState();
+
+const members = [
+  { user_id: 'u-owner', user_name: 'Owner', user_email: 'owner@example.com', role: 'owner' },
+  { user_id: 'u-admin', user_name: 'Admin', user_email: 'admin@example.com', role: 'admin' },
+  { user_id: 'u-member', user_name: 'Member', user_email: 'member@example.com', role: 'member' }
+];
+
+const renderAs = async (role) => {
+  const workspace = { id: 'ws-1', name: 'צוות', role };
+  useStore.setState({ currentWorkspace: workspace, workspaceRole: role, workspaces: [workspace] });
+  const user = userEvent.setup();
+  render(
+    <ModalProvider>
+      <MemoryRouter>
+        <WorkspaceSettings />
+      </MemoryRouter>
+    </ModalProvider>
+  );
+  await screen.findByText('member@example.com');
+  return user;
+};
+
+const row = (email) => screen.getByText(email).closest('.member-row');
+
+beforeEach(() => {
+  useStore.setState(initialState, true);
+  Object.values(workspacesAPI).forEach((fn) => fn.mockReset());
+  workspacesAPI.getMembers.mockResolvedValue(members);
+  workspacesAPI.getInvites.mockResolvedValue([]);
+  workspacesAPI.update.mockResolvedValue({ name: 'שם חדש' });
+});
+
+describe('WorkspaceSettings - what each role can do (matches the server)', () => {
+  it('owner: changes roles, removes anyone but the owner, renames and deletes the workspace', async () => {
+    const user = await renderAs('owner');
+
+    expect(within(row('admin@example.com')).getByRole('combobox')).toHaveValue('admin');
+    expect(within(row('member@example.com')).getByRole('combobox')).toHaveValue('member');
+    expect(within(row('owner@example.com')).queryByRole('combobox')).not.toBeInTheDocument();
+    expect(within(row('admin@example.com')).getByTitle('הסר')).toBeInTheDocument();
+    expect(within(row('owner@example.com')).queryByTitle('הסר')).not.toBeInTheDocument();
+
+    await user.click(screen.getByRole('button', { name: /כללי/ }));
+    expect(screen.getByLabelText('שם ה-Workspace')).toHaveValue('צוות');
+    expect(screen.getByRole('button', { name: 'מחק Workspace' })).toBeInTheDocument();
+  });
+
+  it('admin: renames the workspace and removes members, but cannot change roles or delete it', async () => {
+    const user = await renderAs('admin');
+
+    expect(screen.queryByRole('combobox')).not.toBeInTheDocument();
+    expect(within(row('member@example.com')).getByTitle('הסר')).toBeInTheDocument();
+    expect(within(row('admin@example.com')).queryByTitle('הסר')).not.toBeInTheDocument();
+    expect(screen.getByRole('button', { name: /הזמנות/ })).toBeInTheDocument();
+
+    await user.click(screen.getByRole('button', { name: /כללי/ }));
+    const name = screen.getByLabelText('שם ה-Workspace');
+    await user.clear(name);
+    await user.type(name, 'שם חדש');
+    await user.click(screen.getByRole('button', { name: 'שמור' }));
+    expect(workspacesAPI.update).toHaveBeenCalledWith('ws-1', { name: 'שם חדש' });
+    expect(screen.queryByRole('button', { name: 'מחק Workspace' })).not.toBeInTheDocument();
+  });
+
+  it('member: no management at all', async () => {
+    await renderAs('member');
+
+    expect(screen.queryByRole('combobox')).not.toBeInTheDocument();
+    expect(screen.queryByTitle('הסר')).not.toBeInTheDocument();
+    expect(screen.queryByRole('button', { name: /כללי/ })).not.toBeInTheDocument();
+    expect(screen.queryByRole('button', { name: /הזמנות/ })).not.toBeInTheDocument();
+    expect(workspacesAPI.getInvites).not.toHaveBeenCalled();
+    expect(screen.getByRole('button', { name: 'עזוב את ה-Workspace' })).toBeInTheDocument();
+  });
+});
diff --git a/client/src/routeStyles.js b/client/src/routeStyles.js
new file mode 100644
index 0000000..aba3bcc
--- /dev/null
+++ b/client/src/routeStyles.js
@@ -0,0 +1,59 @@
+// Stylesheets of the lazily loaded pages (App.jsx), imported eagerly and in a fixed order.
+//
+// The page stylesheets are not scoped: several of them define classes that other pages use too
+// (Reminders.css, Settings.css, Credentials.css, ...), so the result depends on the order the rules
+// end up in. All CSS still ships as a single file (build.cssCodeSplit: false in vite.config.js), and
+// this list keeps that file identical to the one built before the pages were code-split: it is the
+// order the stylesheets were first reached when App.jsx imported every page statically, from
+// ClientDetail down to CatalogPage. Without it, the CSS of every lazy page would move after
+// styles/global.css and change which rule wins.
+//
+// A stylesheet that only a lazy page imports and that is missing here still works, but lands at the
+// end of the CSS file - vite.config.js warns about it at build time. Add it here, in the position of
+// the page that first imports it.
+
+// ClientDetail
+import './components/BreadcrumbItem.css';
+import './components/ShareModal.css';
+import './pages/Reminders.css';
+import 'react-quill/dist/quill.snow.css';
+import './components/NotesTab.css';
+import './components/FilesSection.css';
+import './components/TimeEntryItem.css';
+import './components/ActiveTimerEntry.css';
+import './components/SmartPaymentModal.css';
+import './components/TimeSummary.css';
+import './components/Credentials.css';
+import './pages/ClientDetail.css';
+import './styles/reminders-mini.css';
+import './pages/Settings.css'; // through apps/morning
+// Projects
+import './pages/Projects.css';
+// ProjectDetail, TaskDetail, Tasks, Profile
+import './pages/ProjectDetail.css';
+import './pages/TaskDetail.css';
+import './pages/Tasks.css';
+import './pages/Profile.css';
+// SharedClient (also SharedProject, SharedAccess), SharedWithMe, AdminPanel
+import './pages/SharedClient.css';
+import './pages/SharedWithMe.css';
+import './pages/AdminPanel.css';
+// SettingsPage
+import './components/PasskeysManager.css';
+import './pages/SettingsPage.css';
+// LeadsManagement, LeadDetail
+import './components/LeadFilterBar.css';
+import './components/LeadListView.css';
+import './components/LeadKanbanBoard.css';
+import './components/LeadTimelineView.css';
+import './pages/LeadsManagement.css';
+import './components/LeadActivityTimeline.css';
+import './pages/LeadDetail.css';
+// TimeEntries, Payments, Schedule, WorkspaceSettings, JoinWorkspace, CatalogPage
+import './pages/TimeEntries.css';
+import './pages/Payments.css';
+import './pages/Schedule.css';
+import './pages/WorkspaceSettings.css';
+import './pages/JoinWorkspace.css';
+import './components/CatalogModal.css';
+import './pages/CatalogPage.css';
diff --git a/client/src/services/api.js b/client/src/services/api.js
index c6abd36..ec766af 100644
--- a/client/src/services/api.js
+++ b/client/src/services/api.js
@@ -76,11 +76,12 @@ export const authAPI = {
       body: JSON.stringify(data)
     }).then(handleResponse),
 
-  deleteAccount: (password) =>
+  // confirmation: { password } - or { confirmEmail } for a passkey-only account (user.has_password === 0)
+  deleteAccount: (confirmation) =>
     fetch(`${API_BASE}/auth/account`, {
       method: 'DELETE',
       headers: getHeaders(),
-      body: JSON.stringify({ password })
+      body: JSON.stringify(confirmation)
     }).then(handleResponse),
 
   resetPassword: (data) =>
diff --git a/client/src/store/useStore.js b/client/src/store/useStore.js
index b3b0085..7dd0f15 100644
--- a/client/src/store/useStore.js
+++ b/client/src/store/useStore.js
@@ -19,6 +19,9 @@ const useStore = create((set, get) => ({
   
   // Stats state
   dashboardStats: null,
+  // Params of the last dashboard stats load (the selected month or custom range, built by the
+  // Dashboard) - a workspace switch reloads the stats with them
+  dashboardStatsParams: {},
   
   // Integrations state
   integrations: [],
@@ -83,8 +86,13 @@ const useStore = create((set, get) => ({
     }
   },
   
-  // Apply a successful auth response (login / register / passkey flows)
+  // Apply a successful auth response (login / register / passkey / forced-reset flows).
+  // A response that still requires a password reset is not a session yet: nothing is stored and
+  // the user stays logged out, so the routes keep them on /login until the reset succeeded
+  // (Login.jsx then calls this again with the reset response).
   completeAuth: async (response) => {
+    if (response?.requiresPasswordReset) return response;
+
     const { user, token, workspaces, currentWorkspace } = response;
     localStorage.setItem('token', token);
 
@@ -102,10 +110,11 @@ const useStore = create((set, get) => ({
     // Load addons before returning (needed for addon-protected routes and nav links)
     await get().loadEnabledAddons();
     get().loadActiveTimers();
-    return response; // Return full response including requiresPasswordReset if present
+    return response;
   },
 
-  // Login
+  // Login. When the server flags the account for a forced password reset, the response comes back
+  // with requiresPasswordReset and the user is NOT logged in yet (see completeAuth).
   login: async (email, password) => {
     const response = await authAPI.login({ email, password });
     return get().completeAuth(response);
@@ -126,6 +135,7 @@ const useStore = create((set, get) => ({
       isAuthenticated: false,
       activeTimers: [],
       dashboardStats: null,
+      dashboardStatsParams: {},
       workspaces: [],
       currentWorkspace: null,
       workspaceRole: null,
@@ -155,9 +165,9 @@ const useStore = create((set, get) => ({
       reminders: [],
       unreadRemindersCount: 0
     });
-    // Reload workspace-specific data
+    // Reload workspace-specific data (the stats for the period the dashboard is showing)
     get().loadActiveTimers();
-    get().loadDashboardStats();
+    get().loadDashboardStats(get().dashboardStatsParams);
     get().loadIntegrations();
   },
 
@@ -233,12 +243,20 @@ const useStore = create((set, get) => ({
     }
   },
 
-  // Permission helpers
+  // Permission helpers - the same rules as server/middleware/auth.js and routes/workspaces.js
+  // Rename the workspace, list / revoke invites
   canManageWorkspace: () => {
     const role = get().workspaceRole;
-    return role === 'owner';
+    return role === 'owner' || role === 'admin';
   },
 
+  // Only the owner deletes the workspace
+  canDeleteWorkspace: () => get().workspaceRole === 'owner',
+
+  // Only the owner appoints or demotes admins; an admin may change only members, and only to
+  // member - so in practice only the owner changes roles. Nobody changes the owner's role.
+  canChangeMemberRole: (memberRole) => get().workspaceRole === 'owner' && memberRole !== 'owner',
+
   canInviteMembers: () => {
     const role = get().workspaceRole;
     return role === 'owner' || role === 'admin';
@@ -404,7 +422,10 @@ const useStore = create((set, get) => ({
   },
   
   // Stats
+  // The params (the period the Dashboard shows) are remembered, so reloads elsewhere - e.g. after a
+  // workspace switch - can ask for the same period
   loadDashboardStats: async (params = {}) => {
+    set({ dashboardStatsParams: params });
     try {
       const stats = await statsAPI.getDashboard(params);
       set({ dashboardStats: stats });
diff --git a/client/src/store/useStore.test.js b/client/src/store/useStore.test.js
index 6f77ffa..64e0107 100644
--- a/client/src/store/useStore.test.js
+++ b/client/src/store/useStore.test.js
@@ -138,7 +138,7 @@ describe('initAuth', () => {
 
 describe('login / register / logout', () => {
   it('login stores the token and workspace and returns the full response', async () => {
-    const response = { user, token: 'new-token', workspaces: [wsA], currentWorkspace: wsA, requiresPasswordReset: true };
+    const response = { user, token: 'new-token', workspaces: [wsA], currentWorkspace: wsA, requiresPasswordReset: false };
     authAPI.login.mockResolvedValue(response);
     addonsAPI.getEnabled.mockResolvedValue(['files']);
 
@@ -158,6 +158,20 @@ describe('login / register / logout', () => {
     expect(timerAPI.getActive).toHaveBeenCalled();
   });
 
+  it('a login that still requires a password reset is not a session: nothing is stored', async () => {
+    const response = { requiresPasswordReset: true, resetToken: 'reset-jwt' };
+    authAPI.login.mockResolvedValue(response);
+
+    const result = await state().login('dana@example.com', 'secret');
+
+    expect(result).toBe(response);
+    expect(localStorage.getItem('token')).toBeNull();
+    expect(localStorage.getItem('currentWorkspaceId')).toBeNull();
+    expect(state()).toMatchObject({ user: null, isAuthenticated: false, currentWorkspace: null, workspaces: [] });
+    expect(addonsAPI.getEnabled).not.toHaveBeenCalled();
+    expect(timerAPI.getActive).not.toHaveBeenCalled();
+  });
+
   it('login handles a user without workspaces', async () => {
     authAPI.login.mockResolvedValue({ user, token: 't', currentWorkspace: null });
 
@@ -351,7 +365,7 @@ describe('workspaces', () => {
 describe('permission helpers', () => {
   it.each([
     ['owner', { manage: true, invite: true, viewAll: true }],
-    ['admin', { manage: false, invite: true, viewAll: true }],
+    ['admin', { manage: true, invite: true, viewAll: true }],
     ['member', { manage: false, invite: false, viewAll: false }],
     [null, { manage: false, invite: false, viewAll: false }]
   ])('role %s', (role, expected) => {
@@ -361,6 +375,21 @@ describe('permission helpers', () => {
     expect(state().canViewAllTimeEntries()).toBe(expected.viewAll);
   });
 
+  it('only the owner deletes the workspace and changes roles (never the owner\'s own)', () => {
+    useStore.setState({ workspaceRole: 'owner' });
+    expect(state().canDeleteWorkspace()).toBe(true);
+    expect(state().canChangeMemberRole('admin')).toBe(true);
+    expect(state().canChangeMemberRole('member')).toBe(true);
+    expect(state().canChangeMemberRole('owner')).toBe(false);
+
+    for (const role of ['admin', 'member', null]) {
+      useStore.setState({ workspaceRole: role });
+      expect(state().canDeleteWorkspace()).toBe(false);
+      expect(state().canChangeMemberRole('member')).toBe(false);
+      expect(state().canChangeMemberRole('admin')).toBe(false);
+    }
+  });
+
   it('canRemoveMember: owners remove anyone, admins only members', () => {
     useStore.setState({ workspaceRole: 'owner' });
     expect(state().canRemoveMember('admin')).toBe(true);
@@ -570,6 +599,35 @@ describe('integrations and stats', () => {
     await state().loadDashboardStats();
     expect(state().dashboardStats).toEqual({ hours: 5 });
   });
+
+  it('loadDashboardStats remembers the period it loaded', async () => {
+    const range = { startDate: '2026-08-31T21:00:00.000Z', endDate: '2026-09-30T21:00:00.000Z' };
+    await state().loadDashboardStats(range);
+    expect(state().dashboardStatsParams).toEqual(range);
+
+    // Back to the default period: the remembered one follows
+    await state().loadDashboardStats({});
+    expect(state().dashboardStatsParams).toEqual({});
+  });
+
+  it('switching workspace reloads the stats for the period the dashboard shows', async () => {
+    const range = { startDate: '2026-08-31T21:00:00.000Z', endDate: '2026-09-30T21:00:00.000Z' };
+    await state().loadDashboardStats(range);
+    statsAPI.getDashboard.mockClear();
+
+    state().setCurrentWorkspace(wsB);
+
+    await vi.waitFor(() => expect(statsAPI.getDashboard).toHaveBeenCalledWith(range));
+    expect(statsAPI.getDashboard).toHaveBeenCalledTimes(1);
+  });
+
+  it('logout forgets the remembered stats period', async () => {
+    await state().loadDashboardStats({ month: 9, year: 2026 });
+
+    state().logout();
+
+    expect(state().dashboardStatsParams).toEqual({});
+  });
 });
 
 describe('reminders', () => {
diff --git a/client/vite.config.js b/client/vite.config.js
index 73457fd..269638c 100644
--- a/client/vite.config.js
+++ b/client/vite.config.js
@@ -20,9 +20,33 @@ function getServerPort() {
 const serverPort = Number(process.env.CLOCKWIZE_API_PORT) || getServerPort();
 console.log(`🔗 Proxying /api to http://localhost:${serverPort}`);
 
+// The pages are code-split (src/App.jsx), but their CSS is not scoped and pages reuse each other's
+// classes, so all CSS ships as one file in a fixed order (src/routeStyles.js). A stylesheet that is
+// only reachable through a lazy chunk would land at the end of that file, after global.css - warn.
+function lazyChunkCssGuard() {
+  return {
+    name: 'clockwize-lazy-chunk-css',
+    apply: 'build',
+    generateBundle(_, bundle) {
+      for (const chunk of Object.values(bundle)) {
+        if (chunk.type !== 'chunk' || chunk.isEntry) continue;
+        const css = chunk.moduleIds.filter((id) => /\.css($|\?)/.test(id));
+        if (css.length) {
+          this.warn(`${css.map((id) => path.relative(__dirname, id)).join(', ')} only load(s) through the lazy chunk ` +
+            `${chunk.fileName}, so it lands after global.css. Import it in src/routeStyles.js to keep the cascade order.`);
+        }
+      }
+    }
+  };
+}
+
 // פורט 5000 תפוס על ידי macOS ControlCenter, אז משתמשים ב-5001
 export default defineConfig({
-  plugins: [react()],
+  plugins: [react(), lazyChunkCssGuard()],
+  build: {
+    // One stylesheet for the whole app, in the same cascade order as before the code split
+    cssCodeSplit: false
+  },
   server: {
     port: 5001,
     strictPort: false,
diff --git a/desktop/lib/tray.js b/desktop/lib/tray.js
index 7d2d47a..255cfa3 100644
--- a/desktop/lib/tray.js
+++ b/desktop/lib/tray.js
@@ -84,6 +84,7 @@ function createMenuBar({ state, showWindow, openInApp }) {
     });
     // No setVisibleOnAllWorkspaces() here: on macOS it flips the app to a UIElement process,
     // which removes the Dock icon. A 'panel' window already shows on every Space.
+    if (process.env.CLOCKWIZE_E2E_INVISIBLE) popover.setOpacity(0);
     popover.loadFile(path.join(__dirname, '..', 'popover.html'));
     popover.on('blur', () => {
       if (!popover.webContents.isDevToolsOpened()) {
diff --git a/desktop/main.js b/desktop/main.js
index a2ee33d..e950670 100644
--- a/desktop/main.js
+++ b/desktop/main.js
@@ -94,6 +94,8 @@ function createWindow() {
     }
   });
 
+  // Automated tests (desktop/tests) keep their windows invisible so they don't flash on screen
+  if (process.env.CLOCKWIZE_E2E_INVISIBLE) mainWindow.setOpacity(0);
   mainWindow.once('ready-to-show', () => mainWindow.show());
   mainWindow.on('resize', saveWindowState);
   mainWindow.on('move', saveWindowState);
diff --git a/desktop/scripts/install-app.js b/desktop/scripts/install-app.js
index 1b066c6..5c6a038 100644
--- a/desktop/scripts/install-app.js
+++ b/desktop/scripts/install-app.js
@@ -143,6 +143,13 @@ if (fs.existsSync(TARGET)) {
 step(`Installing to ${TARGET}`);
 run('ditto', [built, TARGET]);
 run(LSREGISTER, ['-f', TARGET]);
+// The Dock caches the icon of a pinned app by file; after the bundle is replaced it can show a
+// grey placeholder until it reloads. Refresh it when Clockwize is pinned.
+execFileSync('touch', [TARGET]);
+try {
+  const pinned = execFileSync('defaults', ['read', 'com.apple.dock', 'persistent-apps'], { encoding: 'utf8' }).includes(BUNDLE_ID);
+  if (pinned) execFileSync('killall', ['Dock']);
+} catch { /* Dock not running or not readable - nothing to refresh */ }
 if (widget && identity) {
   // Make the widget show up in the widget gallery and in Control Center right away
   try { execFileSync('pluginkit', ['-a', path.join(TARGET, 'Contents', 'PlugIns', 'ClockwizeWidget.appex')]); } catch { /* registered on first launch anyway */ }
diff --git a/desktop/tests/desktop.spec.mjs b/desktop/tests/desktop.spec.mjs
index 9b0b57d..4bab94b 100644
--- a/desktop/tests/desktop.spec.mjs
+++ b/desktop/tests/desktop.spec.mjs
@@ -37,7 +37,9 @@ test.beforeEach(async () => {
       CLOCKWIZE_PORT_FILE: path.join(tmp, '.server-port'),
       CLOCKWIZE_SESSION_FILE: path.join(tmp, '.local-session'),
       CLOCKWIZE_WIDGET_PORT: String(WIDGET_PORT),
-      CLOCKWIZE_WIDGET_SECRET: WIDGET_SECRET
+      CLOCKWIZE_WIDGET_SECRET: WIDGET_SECRET,
+      // Don't flash windows on the developer's screen while the suite runs
+      CLOCKWIZE_E2E_INVISIBLE: '1'
     }
   });
 });
diff --git a/e2e/auth.spec.js b/e2e/auth.spec.js
index c39d326..0274255 100644
--- a/e2e/auth.spec.js
+++ b/e2e/auth.spec.js
@@ -1,5 +1,15 @@
 import { test, expect } from '@playwright/test';
-import { PASSWORD, registerUser, uniqueEmail, uniqueName } from './helpers.js';
+import {
+  PASSWORD,
+  acknowledge,
+  apiAs,
+  appDialog,
+  loginInBrowser,
+  loginUser,
+  registerUser,
+  uniqueEmail,
+  uniqueName
+} from './helpers.js';
 
 const loginForm = (page) => ({
   email: page.getByPlaceholder('admin או your@email.com'),
@@ -72,6 +82,59 @@ test.describe('auth', () => {
     expect(await page.evaluate(() => localStorage.getItem('token'))).toBeNull();
   });
 
+  test('a user flagged for a forced password reset must set a new password before entering', async ({ page, request }) => {
+    const user = await registerUser(request);
+    const admin = await loginUser(request, 'admin', 'admin');
+
+    // Flagging ends the session the user already has
+    await loginInBrowser(page, user);
+    await expect(page.getByRole('heading', { name: `שלום, ${user.name}!` })).toBeVisible();
+    await apiAs(request, admin).post(`/api/admin/users/${user.user.id}/force-password-reset`);
+    await page.reload();
+    await expect(page).toHaveURL(/\/login$/);
+    expect(await page.evaluate(() => localStorage.getItem('token'))).toBeNull();
+
+    const form = loginForm(page);
+    const dialog = appDialog(page);
+    const resetHeading = dialog.getByRole('heading', { name: 'נדרש איפוס סיסמה' });
+    const newPasswordInput = dialog.getByLabel('הזן סיסמה חדשה (לפחות 4 תווים):');
+    const signIn = async () => {
+      await form.email.fill(user.email);
+      await form.password.fill(PASSWORD);
+      await form.submit.click();
+      await expect(resetHeading).toBeVisible();
+    };
+
+    // Cancelling the reset leaves the user logged out, also after a reload
+    await page.goto('/login');
+    await signIn();
+    await expect(newPasswordInput).toHaveAttribute('type', 'password');
+    await expect(page).toHaveURL(/\/login$/);
+    expect(await page.evaluate(() => localStorage.getItem('token'))).toBeNull();
+    await dialog.getByRole('button', { name: 'ביטול', exact: true }).click();
+    await expect(page.getByText('חובה לשנות סיסמה כדי להמשיך')).toBeVisible();
+    await page.goto('/');
+    await expect(page).toHaveURL(/\/login$/);
+
+    // Setting the new password signs the user in
+    const newPassword = `${PASSWORD}-new`;
+    await signIn();
+    await newPasswordInput.fill(newPassword);
+    await dialog.getByRole('button', { name: 'אישור', exact: true }).click();
+    await acknowledge(page, 'סיסמה שונתה בהצלחה!');
+    await expect(page).toHaveURL(/\/$/);
+    await expect(page.getByRole('heading', { name: `שלום, ${user.name}!` })).toBeVisible();
+
+    // The session survives a reload, and the new password is the one that works from now on
+    await page.reload();
+    await expect(page.getByRole('heading', { name: `שלום, ${user.name}!` })).toBeVisible();
+    const oldLogin = await request.post('/api/auth/login', { data: { email: user.email, password: PASSWORD } });
+    expect(oldLogin.status()).toBe(401);
+    const newLogin = await request.post('/api/auth/login', { data: { email: user.email, password: newPassword } });
+    expect(newLogin.status()).toBe(200);
+    expect((await newLogin.json()).requiresPasswordReset).toBe(false);
+  });
+
   test('protected routes redirect to /login when logged out', async ({ page }) => {
     for (const path of ['/', '/projects', '/tasks', '/time-entries', '/settings']) {
       await page.goto(path);
diff --git a/e2e/core-flow.spec.js b/e2e/core-flow.spec.js
index cf7678e..62b4e4f 100644
--- a/e2e/core-flow.spec.js
+++ b/e2e/core-flow.spec.js
@@ -3,7 +3,6 @@ import {
   acknowledge,
   apiAs,
   confirmDialog,
-  field,
   loginInBrowser,
   modal,
   registerUser,
@@ -29,7 +28,7 @@ test.describe('core flow', () => {
     // --- Client (dashboard) ---
     await page.getByRole('button', { name: 'לקוח חדש', exact: true }).click();
     const clientModal = modal(page, 'לקוח חדש');
-    await field(clientModal, 'שם לקוח').fill(clientName);
+    await clientModal.getByLabel('שם לקוח *', { exact: true }).fill(clientName);
     await clientModal.getByRole('button', { name: 'שמור', exact: true }).click();
     await acknowledge(page, 'הלקוח נוסף בהצלחה');
     await expect(clientModal).toBeHidden();
@@ -42,8 +41,8 @@ test.describe('core flow', () => {
     await page.getByRole('button', { name: 'צור פרויקט חדש' }).click();
     const projectModal = modal(page, 'פרויקט חדש');
     // Opened from a client page, the client is preselected
-    await expect(field(projectModal, 'לקוח')).toHaveValue(/[\w-]{8,}/);
-    await field(projectModal, 'שם הפרויקט').fill(projectName);
+    await expect(projectModal.getByLabel('לקוח *', { exact: true })).toHaveValue(/[\w-]{8,}/);
+    await projectModal.getByLabel('שם הפרויקט *', { exact: true }).fill(projectName);
     await projectModal.getByRole('button', { name: 'שמור', exact: true }).click();
     await expect(projectModal).toBeHidden();
 
@@ -54,7 +53,7 @@ test.describe('core flow', () => {
     // --- Task (project page) ---
     await page.getByRole('button', { name: 'צור משימה חדשה' }).click();
     const taskModal = modal(page, 'משימה חדשה');
-    await field(taskModal, 'שם המשימה').fill(taskName);
+    await taskModal.getByLabel('שם המשימה *', { exact: true }).fill(taskName);
     await taskModal.getByRole('button', { name: 'שמור', exact: true }).click();
     await expect(taskModal).toBeHidden();
 
@@ -102,7 +101,7 @@ test.describe('core flow', () => {
 
     await page.getByRole('button', { name: 'עריכה', exact: true }).click();
     const clientModal = modal(page, 'עריכת לקוח');
-    const clientNameInput = field(clientModal, 'שם לקוח');
+    const clientNameInput = clientModal.getByLabel('שם לקוח *', { exact: true });
     await expect(clientNameInput).toHaveValue(client.name);
     const renamedClient = uniqueName('לקוח מעודכן');
     await clientNameInput.fill(renamedClient);
@@ -114,7 +113,7 @@ test.describe('core flow', () => {
     const projectRow = page.locator('.tab-content .list-item').filter({ hasText: project.name });
     await projectRow.getByTitle('ערוך').click();
     const projectModal = modal(page, 'עריכת פרויקט');
-    const projectNameInput = field(projectModal, 'שם הפרויקט');
+    const projectNameInput = projectModal.getByLabel('שם הפרויקט *', { exact: true });
     await expect(projectNameInput).toHaveValue(project.name);
     const renamedProject = uniqueName('פרויקט מעודכן');
     await projectNameInput.fill(renamedProject);
diff --git a/e2e/helpers.js b/e2e/helpers.js
index 308354d..65a6147 100644
--- a/e2e/helpers.js
+++ b/e2e/helpers.js
@@ -81,14 +81,11 @@ export async function loginInBrowser(page, session, path = '/') {
 
 // ---------- UI helpers ----------
 
-// The app's forms put <label class="form-label"> next to the control without htmlFor/id, so
-// getByLabel can't resolve them. Find the .form-group that owns the label text instead.
+// The app's form labels are tied to their controls (<label htmlFor> + id), so look fields up with
+// Playwright's getByLabel, scoped to the form or modal: modal.getByLabel('שם לקוח *', { exact: true }).
+// field() is kept for older specs; it matches the label text as a substring like it used to.
 export function field(scope, labelText) {
-  return scope
-    .locator('.form-group')
-    .filter({ has: scope.page().locator('.form-label', { hasText: labelText }) })
-    .locator('input, select, textarea')
-    .first();
+  return scope.getByLabel(labelText).first();
 }
 
 // Form modals (ClientModal / ProjectModal / TaskModal / stop-timer) have no role="dialog";
diff --git a/menubar/ClockwizeMenuBar.xcodeproj/project.pbxproj b/menubar/ClockwizeMenuBar.xcodeproj/project.pbxproj
deleted file mode 100644
index 33fc26d..0000000
--- a/menubar/ClockwizeMenuBar.xcodeproj/project.pbxproj
+++ /dev/null
@@ -1,345 +0,0 @@
-// !$*UTF8*$!
-{
-	archiveVersion = 1;
-	classes = {
-	};
-	objectVersion = 56;
-	objects = {
-
-/* Begin PBXBuildFile section */
-		001 /* AppDelegate.swift in Sources */ = {isa = PBXBuildFile; fileRef = 101 /* AppDelegate.swift */; };
-		002 /* StatusBarController.swift in Sources */ = {isa = PBXBuildFile; fileRef = 102 /* StatusBarController.swift */; };
-		003 /* TimerAPI.swift in Sources */ = {isa = PBXBuildFile; fileRef = 103 /* TimerAPI.swift */; };
-		004 /* Models.swift in Sources */ = {isa = PBXBuildFile; fileRef = 104 /* Models.swift */; };
-		005 /* AuthManager.swift in Sources */ = {isa = PBXBuildFile; fileRef = 105 /* AuthManager.swift */; };
-		006 /* LoginViewController.swift in Sources */ = {isa = PBXBuildFile; fileRef = 106 /* LoginViewController.swift */; };
-/* End PBXBuildFile section */
-
-/* Begin PBXFileReference section */
-		100 /* ClockwizeMenuBar.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = ClockwizeMenuBar.app; sourceTree = BUILT_PRODUCTS_DIR; };
-		101 /* AppDelegate.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = AppDelegate.swift; sourceTree = "<group>"; };
-		102 /* StatusBarController.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = StatusBarController.swift; sourceTree = "<group>"; };
-		103 /* TimerAPI.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = TimerAPI.swift; sourceTree = "<group>"; };
-		104 /* Models.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Models.swift; sourceTree = "<group>"; };
-		105 /* AuthManager.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = AuthManager.swift; sourceTree = "<group>"; };
-		106 /* LoginViewController.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = LoginViewController.swift; sourceTree = "<group>"; };
-		107 /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
-/* End PBXFileReference section */
-
-/* Begin PBXFrameworksBuildPhase section */
-		200 /* Frameworks */ = {
-			isa = PBXFrameworksBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-/* End PBXFrameworksBuildPhase section */
-
-/* Begin PBXGroup section */
-		300 = {
-			isa = PBXGroup;
-			children = (
-				310 /* ClockwizeMenuBar */,
-				320 /* Products */,
-			);
-			sourceTree = "<group>";
-		};
-		310 /* ClockwizeMenuBar */ = {
-			isa = PBXGroup;
-			children = (
-				101 /* AppDelegate.swift */,
-				102 /* StatusBarController.swift */,
-				103 /* TimerAPI.swift */,
-				104 /* Models.swift */,
-				105 /* AuthManager.swift */,
-				106 /* LoginViewController.swift */,
-				107 /* Info.plist */,
-			);
-			path = ClockwizeMenuBar;
-			sourceTree = "<group>";
-		};
-		320 /* Products */ = {
-			isa = PBXGroup;
-			children = (
-				100 /* ClockwizeMenuBar.app */,
-			);
-			name = Products;
-			sourceTree = "<group>";
-		};
-/* End PBXGroup section */
-
-/* Begin PBXNativeTarget section */
-		400 /* ClockwizeMenuBar */ = {
-			isa = PBXNativeTarget;
-			buildConfigurationList = 500 /* Build configuration list for PBXNativeTarget "ClockwizeMenuBar" */;
-			buildPhases = (
-				410 /* Sources */,
-				200 /* Frameworks */,
-				420 /* Resources */,
-			);
-			buildRules = (
-			);
-			dependencies = (
-			);
-			name = ClockwizeMenuBar;
-			productName = ClockwizeMenuBar;
-			productReference = 100 /* ClockwizeMenuBar.app */;
-			productType = "com.apple.product-type.application";
-		};
-/* End PBXNativeTarget section */
-
-/* Begin PBXProject section */
-		600 /* Project object */ = {
-			isa = PBXProject;
-			attributes = {
-				BuildIndependentTargetsInParallel = 1;
-				LastSwiftUpdateCheck = 1500;
-				LastUpgradeCheck = 1500;
-				TargetAttributes = {
-					400 = {
-						CreatedOnToolsVersion = 15.0;
-					};
-				};
-			};
-			buildConfigurationList = 610 /* Build configuration list for PBXProject "ClockwizeMenuBar" */;
-			compatibilityVersion = "Xcode 14.0";
-			developmentRegion = he;
-			hasScannedForEncodings = 0;
-			knownRegions = (
-				en,
-				he,
-				Base,
-			);
-			mainGroup = 300;
-			productRefGroup = 320 /* Products */;
-			projectDirPath = "";
-			projectRoot = "";
-			targets = (
-				400 /* ClockwizeMenuBar */,
-			);
-		};
-/* End PBXProject section */
-
-/* Begin PBXResourcesBuildPhase section */
-		420 /* Resources */ = {
-			isa = PBXResourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-/* End PBXResourcesBuildPhase section */
-
-/* Begin PBXSourcesBuildPhase section */
-		410 /* Sources */ = {
-			isa = PBXSourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				001 /* AppDelegate.swift in Sources */,
-				002 /* StatusBarController.swift in Sources */,
-				003 /* TimerAPI.swift in Sources */,
-				004 /* Models.swift in Sources */,
-				005 /* AuthManager.swift in Sources */,
-				006 /* LoginViewController.swift in Sources */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-/* End PBXSourcesBuildPhase section */
-
-/* Begin XCBuildConfiguration section */
-		700 /* Debug */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_SEARCH_USER_PATHS = NO;
-				ASSETCATALOG_COMPILER_GENERATE_SWIFT_ASSET_SYMBOL_EXTENSIONS = YES;
-				CLANG_ANALYZER_NONNULL = YES;
-				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
-				CLANG_CXX_LANGUAGE_STANDARD = "gnu++20";
-				CLANG_ENABLE_MODULES = YES;
-				CLANG_ENABLE_OBJC_ARC = YES;
-				CLANG_ENABLE_OBJC_WEAK = YES;
-				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
-				CLANG_WARN_BOOL_CONVERSION = YES;
-				CLANG_WARN_COMMA = YES;
-				CLANG_WARN_CONSTANT_CONVERSION = YES;
-				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
-				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
-				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
-				CLANG_WARN_EMPTY_BODY = YES;
-				CLANG_WARN_ENUM_CONVERSION = YES;
-				CLANG_WARN_INFINITE_RECURSION = YES;
-				CLANG_WARN_INT_CONVERSION = YES;
-				CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
-				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
-				CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
-				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
-				CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES;
-				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
-				CLANG_WARN_STRICT_PROTOTYPES = YES;
-				CLANG_WARN_SUSPICIOUS_MOVE = YES;
-				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
-				CLANG_WARN_UNREACHABLE_CODE = YES;
-				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
-				COPY_PHASE_STRIP = NO;
-				DEBUG_INFORMATION_FORMAT = dwarf;
-				ENABLE_STRICT_OBJC_MSGSEND = YES;
-				ENABLE_TESTABILITY = YES;
-				ENABLE_USER_SCRIPT_SANDBOXING = YES;
-				GCC_C_LANGUAGE_STANDARD = gnu17;
-				GCC_DYNAMIC_NO_PIC = NO;
-				GCC_NO_COMMON_BLOCKS = YES;
-				GCC_OPTIMIZATION_LEVEL = 0;
-				GCC_PREPROCESSOR_DEFINITIONS = (
-					"DEBUG=1",
-					"$(inherited)",
-				);
-				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
-				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
-				GCC_WARN_UNDECLARED_SELECTOR = YES;
-				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
-				GCC_WARN_UNUSED_FUNCTION = YES;
-				GCC_WARN_UNUSED_VARIABLE = YES;
-				LOCALIZATION_PREFERS_STRING_CATALOGS = YES;
-				MACOSX_DEPLOYMENT_TARGET = 11.0;
-				MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
-				MTL_FAST_MATH = YES;
-				ONLY_ACTIVE_ARCH = YES;
-				SDKROOT = macosx;
-				SWIFT_ACTIVE_COMPILATION_CONDITIONS = "DEBUG $(inherited)";
-				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
-			};
-			name = Debug;
-		};
-		701 /* Release */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_SEARCH_USER_PATHS = NO;
-				ASSETCATALOG_COMPILER_GENERATE_SWIFT_ASSET_SYMBOL_EXTENSIONS = YES;
-				CLANG_ANALYZER_NONNULL = YES;
-				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
-				CLANG_CXX_LANGUAGE_STANDARD = "gnu++20";
-				CLANG_ENABLE_MODULES = YES;
-				CLANG_ENABLE_OBJC_ARC = YES;
-				CLANG_ENABLE_OBJC_WEAK = YES;
-				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
-				CLANG_WARN_BOOL_CONVERSION = YES;
-				CLANG_WARN_COMMA = YES;
-				CLANG_WARN_CONSTANT_CONVERSION = YES;
-				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
-				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
-				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
-				CLANG_WARN_EMPTY_BODY = YES;
-				CLANG_WARN_ENUM_CONVERSION = YES;
-				CLANG_WARN_INFINITE_RECURSION = YES;
-				CLANG_WARN_INT_CONVERSION = YES;
-				CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
-				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
-				CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
-				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
-				CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES;
-				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
-				CLANG_WARN_STRICT_PROTOTYPES = YES;
-				CLANG_WARN_SUSPICIOUS_MOVE = YES;
-				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
-				CLANG_WARN_UNREACHABLE_CODE = YES;
-				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
-				COPY_PHASE_STRIP = NO;
-				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
-				ENABLE_NS_ASSERTIONS = NO;
-				ENABLE_STRICT_OBJC_MSGSEND = YES;
-				ENABLE_USER_SCRIPT_SANDBOXING = YES;
-				GCC_C_LANGUAGE_STANDARD = gnu17;
-				GCC_NO_COMMON_BLOCKS = YES;
-				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
-				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
-				GCC_WARN_UNDECLARED_SELECTOR = YES;
-				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
-				GCC_WARN_UNUSED_FUNCTION = YES;
-				GCC_WARN_UNUSED_VARIABLE = YES;
-				LOCALIZATION_PREFERS_STRING_CATALOGS = YES;
-				MACOSX_DEPLOYMENT_TARGET = 11.0;
-				MTL_ENABLE_DEBUG_INFO = NO;
-				MTL_FAST_MATH = YES;
-				SDKROOT = macosx;
-				SWIFT_COMPILATION_MODE = wholemodule;
-			};
-			name = Release;
-		};
-		710 /* Debug */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
-				ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME = AccentColor;
-				CODE_SIGN_ENTITLEMENTS = "";
-				CODE_SIGN_STYLE = Automatic;
-				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 1;
-				GENERATE_INFOPLIST_FILE = NO;
-				INFOPLIST_FILE = ClockwizeMenuBar/Info.plist;
-				INFOPLIST_KEY_LSApplicationCategoryType = "public.app-category.productivity";
-				INFOPLIST_KEY_LSUIElement = YES;
-				INFOPLIST_KEY_NSHumanReadableCopyright = "";
-				LD_RUNPATH_SEARCH_PATHS = (
-					"$(inherited)",
-					"@executable_path/../Frameworks",
-				);
-				MARKETING_VERSION = 1.0;
-				PRODUCT_BUNDLE_IDENTIFIER = com.clockwize.menubar;
-				PRODUCT_NAME = "$(TARGET_NAME)";
-				SWIFT_EMIT_LOC_STRINGS = YES;
-				SWIFT_VERSION = 5.0;
-			};
-			name = Debug;
-		};
-		711 /* Release */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
-				ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME = AccentColor;
-				CODE_SIGN_ENTITLEMENTS = "";
-				CODE_SIGN_STYLE = Automatic;
-				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 1;
-				GENERATE_INFOPLIST_FILE = NO;
-				INFOPLIST_FILE = ClockwizeMenuBar/Info.plist;
-				INFOPLIST_KEY_LSApplicationCategoryType = "public.app-category.productivity";
-				INFOPLIST_KEY_LSUIElement = YES;
-				INFOPLIST_KEY_NSHumanReadableCopyright = "";
-				LD_RUNPATH_SEARCH_PATHS = (
-					"$(inherited)",
-					"@executable_path/../Frameworks",
-				);
-				MARKETING_VERSION = 1.0;
-				PRODUCT_BUNDLE_IDENTIFIER = com.clockwize.menubar;
-				PRODUCT_NAME = "$(TARGET_NAME)";
-				SWIFT_EMIT_LOC_STRINGS = YES;
-				SWIFT_VERSION = 5.0;
-			};
-			name = Release;
-		};
-/* End XCBuildConfiguration section */
-
-/* Begin XCConfigurationList section */
-		500 /* Build configuration list for PBXNativeTarget "ClockwizeMenuBar" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				710 /* Debug */,
-				711 /* Release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = Release;
-		};
-		610 /* Build configuration list for PBXProject "ClockwizeMenuBar" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				700 /* Debug */,
-				701 /* Release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = Release;
-		};
-/* End XCConfigurationList section */
-	};
-	rootObject = 600 /* Project object */;
-}
diff --git a/menubar/ClockwizeMenuBar/AppDelegate.swift b/menubar/ClockwizeMenuBar/AppDelegate.swift
deleted file mode 100644
index ead23eb..0000000
--- a/menubar/ClockwizeMenuBar/AppDelegate.swift
+++ /dev/null
@@ -1,42 +0,0 @@
-import Cocoa
-
-@main
-class AppDelegate: NSObject, NSApplicationDelegate {
-    
-    var statusBarController: StatusBarController?
-    var preferencesWindow: NSWindow?
-    
-    func applicationDidFinishLaunching(_ notification: Notification) {
-        // Hide dock icon (we're a menu bar only app)
-        NSApp.setActivationPolicy(.accessory)
-        
-        // Initialize status bar
-        statusBarController = StatusBarController()
-        
-        // Check if we have saved credentials
-        if !AuthManager.shared.isLoggedIn {
-            showLoginWindow()
-        }
-    }
-    
-    func showLoginWindow() {
-        let loginVC = LoginViewController()
-        let window = NSWindow(
-            contentRect: NSRect(x: 0, y: 0, width: 400, height: 300),
-            styleMask: [.titled, .closable],
-            backing: .buffered,
-            defer: false
-        )
-        window.title = "Clockwize - התחברות"
-        window.contentViewController = loginVC
-        window.center()
-        window.makeKeyAndOrderFront(nil)
-        NSApp.activate(ignoringOtherApps: true)
-        
-        preferencesWindow = window
-    }
-    
-    func applicationWillTerminate(_ notification: Notification) {
-        // Cleanup
-    }
-}
diff --git a/menubar/ClockwizeMenuBar/AuthManager.swift b/menubar/ClockwizeMenuBar/AuthManager.swift
deleted file mode 100644
index 93b1fb2..0000000
--- a/menubar/ClockwizeMenuBar/AuthManager.swift
+++ /dev/null
@@ -1,63 +0,0 @@
-import Foundation
-import Security
-
-class AuthManager {
-    
-    static let shared = AuthManager()
-    
-    private let tokenKey = "com.clockwize.menubar.token"
-    private let workspaceKey = "com.clockwize.menubar.workspace"
-    private let userDefaults = UserDefaults.standard
-    
-    private init() {}
-    
-    // MARK: - Token
-    
-    var token: String? {
-        get {
-            return userDefaults.string(forKey: tokenKey)
-        }
-        set {
-            if let value = newValue {
-                userDefaults.set(value, forKey: tokenKey)
-            } else {
-                userDefaults.removeObject(forKey: tokenKey)
-            }
-        }
-    }
-    
-    // MARK: - Workspace ID
-    
-    var workspaceId: String? {
-        get {
-            return userDefaults.string(forKey: workspaceKey)
-        }
-        set {
-            if let value = newValue {
-                userDefaults.set(value, forKey: workspaceKey)
-            } else {
-                userDefaults.removeObject(forKey: workspaceKey)
-            }
-        }
-    }
-    
-    // MARK: - Auth Status
-    
-    var isLoggedIn: Bool {
-        return token != nil && workspaceId != nil
-    }
-    
-    // MARK: - Login
-    
-    func login(token: String, workspaceId: String) {
-        self.token = token
-        self.workspaceId = workspaceId
-    }
-    
-    // MARK: - Logout
-    
-    func logout() {
-        token = nil
-        workspaceId = nil
-    }
-}
diff --git a/menubar/ClockwizeMenuBar/Info.plist b/menubar/ClockwizeMenuBar/Info.plist
deleted file mode 100644
index 4673bdf..0000000
--- a/menubar/ClockwizeMenuBar/Info.plist
+++ /dev/null
@@ -1,37 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-    <key>CFBundleExecutable</key>
-    <string>ClockwizeMenuBar</string>
-    <key>CFBundleIconFile</key>
-    <string>AppIcon</string>
-    <key>CFBundleIdentifier</key>
-    <string>com.clockwize.menubar</string>
-    <key>CFBundleName</key>
-    <string>Clockwize Menu Bar</string>
-    <key>CFBundleDisplayName</key>
-    <string>Clockwize</string>
-    <key>CFBundlePackageType</key>
-    <string>APPL</string>
-    <key>CFBundleShortVersionString</key>
-    <string>1.0.0</string>
-    <key>CFBundleVersion</key>
-    <string>1</string>
-    <key>LSMinimumSystemVersion</key>
-    <string>10.15</string>
-    <key>NSHighResolutionCapable</key>
-    <true/>
-    <key>LSUIElement</key>
-    <true/>
-    <key>NSAppTransportSecurity</key>
-    <dict>
-        <key>NSAllowsLocalNetworking</key>
-        <true/>
-        <key>NSAllowsArbitraryLoads</key>
-        <true/>
-    </dict>
-    <key>LSApplicationCategoryType</key>
-    <string>public.app-category.productivity</string>
-</dict>
-</plist>
diff --git a/menubar/ClockwizeMenuBar/LoginViewController.swift b/menubar/ClockwizeMenuBar/LoginViewController.swift
deleted file mode 100644
index 99d2cf4..0000000
--- a/menubar/ClockwizeMenuBar/LoginViewController.swift
+++ /dev/null
@@ -1,157 +0,0 @@
-import Cocoa
-
-class LoginViewController: NSViewController {
-    
-    private let emailField = NSTextField()
-    private let passwordField = NSSecureTextField()
-    private let loginButton = NSButton()
-    private let statusLabel = NSTextField()
-    private let spinner = NSProgressIndicator()
-    
-    override func loadView() {
-        view = NSView(frame: NSRect(x: 0, y: 0, width: 400, height: 300))
-    }
-    
-    override func viewDidLoad() {
-        super.viewDidLoad()
-        setupUI()
-    }
-    
-    private func setupUI() {
-        view.wantsLayer = true
-        view.layer?.backgroundColor = NSColor.windowBackgroundColor.cgColor
-        
-        // לוגו / כותרת
-        let titleLabel = NSTextField(labelWithString: "🕐 Clockwize")
-        titleLabel.font = NSFont.systemFont(ofSize: 28, weight: .bold)
-        titleLabel.alignment = .center
-        titleLabel.frame = NSRect(x: 50, y: 230, width: 300, height: 40)
-        view.addSubview(titleLabel)
-        
-        let subtitleLabel = NSTextField(labelWithString: "התחבר לחשבון שלך")
-        subtitleLabel.font = NSFont.systemFont(ofSize: 14)
-        subtitleLabel.textColor = .secondaryLabelColor
-        subtitleLabel.alignment = .center
-        subtitleLabel.frame = NSRect(x: 50, y: 205, width: 300, height: 20)
-        view.addSubview(subtitleLabel)
-        
-        // שדה אימייל
-        let emailLabel = NSTextField(labelWithString: "אימייל:")
-        emailLabel.frame = NSRect(x: 50, y: 165, width: 300, height: 20)
-        view.addSubview(emailLabel)
-        
-        emailField.frame = NSRect(x: 50, y: 140, width: 300, height: 24)
-        emailField.placeholderString = "your@email.com"
-        view.addSubview(emailField)
-        
-        // שדה סיסמא
-        let passwordLabel = NSTextField(labelWithString: "סיסמא:")
-        passwordLabel.frame = NSRect(x: 50, y: 105, width: 300, height: 20)
-        view.addSubview(passwordLabel)
-        
-        passwordField.frame = NSRect(x: 50, y: 80, width: 300, height: 24)
-        passwordField.placeholderString = "••••••••"
-        view.addSubview(passwordField)
-        
-        // כפתור התחברות
-        loginButton.title = "התחבר"
-        loginButton.bezelStyle = .rounded
-        loginButton.frame = NSRect(x: 150, y: 35, width: 100, height: 32)
-        loginButton.target = self
-        loginButton.action = #selector(loginTapped)
-        loginButton.keyEquivalent = "\r" // Enter key
-        view.addSubview(loginButton)
-        
-        // ספינר
-        spinner.style = .spinning
-        spinner.frame = NSRect(x: 260, y: 40, width: 20, height: 20)
-        spinner.isHidden = true
-        view.addSubview(spinner)
-        
-        // הודעת סטטוס
-        statusLabel.frame = NSRect(x: 50, y: 5, width: 300, height: 20)
-        statusLabel.alignment = .center
-        statusLabel.textColor = .systemRed
-        statusLabel.font = NSFont.systemFont(ofSize: 12)
-        statusLabel.isBezeled = false
-        statusLabel.drawsBackground = false
-        statusLabel.isEditable = false
-        statusLabel.isSelectable = false
-        statusLabel.stringValue = ""
-        view.addSubview(statusLabel)
-    }
-    
-    @objc private func loginTapped() {
-        let email = emailField.stringValue.trimmingCharacters(in: .whitespaces)
-        let password = passwordField.stringValue
-        
-        guard !email.isEmpty else {
-            statusLabel.stringValue = "נא להזין אימייל"
-            return
-        }
-        
-        guard !password.isEmpty else {
-            statusLabel.stringValue = "נא להזין סיסמא"
-            return
-        }
-        
-        setLoading(true)
-        statusLabel.stringValue = ""
-        
-        TimerAPI.shared.login(email: email, password: password) { [weak self] result in
-            DispatchQueue.main.async {
-                switch result {
-                case .success(let response):
-                    // קבלת רשימת workspaces
-                    self?.fetchWorkspaces(token: response.token)
-                case .failure(let error):
-                    self?.setLoading(false)
-                    self?.statusLabel.stringValue = error.localizedDescription
-                }
-            }
-        }
-    }
-    
-    private func fetchWorkspaces(token: String) {
-        TimerAPI.shared.getWorkspaces(token: token) { [weak self] result in
-            DispatchQueue.main.async {
-                self?.setLoading(false)
-                
-                switch result {
-                case .success(let workspaces):
-                    if let firstWorkspace = workspaces.first {
-                        // שמירת ההתחברות
-                        AuthManager.shared.login(token: token, workspaceId: firstWorkspace.id)
-                        
-                        // סגירת החלון
-                        self?.view.window?.close()
-                        
-                        // הצגת הודעה
-                        let notification = NSUserNotification()
-                        notification.title = "Clockwize"
-                        notification.informativeText = "התחברת בהצלחה!"
-                        NSUserNotificationCenter.default.deliver(notification)
-                    } else {
-                        self?.statusLabel.stringValue = "לא נמצאו workspaces"
-                    }
-                case .failure(let error):
-                    self?.statusLabel.stringValue = error.localizedDescription
-                }
-            }
-        }
-    }
-    
-    private func setLoading(_ loading: Bool) {
-        loginButton.isEnabled = !loading
-        emailField.isEnabled = !loading
-        passwordField.isEnabled = !loading
-        
-        if loading {
-            spinner.isHidden = false
-            spinner.startAnimation(nil)
-        } else {
-            spinner.stopAnimation(nil)
-            spinner.isHidden = true
-        }
-    }
-}
diff --git a/menubar/ClockwizeMenuBar/Models.swift b/menubar/ClockwizeMenuBar/Models.swift
deleted file mode 100644
index 8c25516..0000000
--- a/menubar/ClockwizeMenuBar/Models.swift
+++ /dev/null
@@ -1,98 +0,0 @@
-import Foundation
-
-// MARK: - Active Timer
-
-struct ActiveTimer: Codable {
-    let id: String
-    let user_id: String
-    let workspace_id: String
-    let project_id: String
-    let task_id: String?
-    let start_time: String
-    let accumulated_seconds: Int
-    let is_running: Bool
-    let project_name: String?
-    let task_name: String?
-    let client_name: String?
-    
-    // Handle different formats from server
-    enum CodingKeys: String, CodingKey {
-        case id
-        case user_id
-        case workspace_id
-        case project_id
-        case task_id
-        case start_time
-        case accumulated_seconds
-        case is_running
-        case project_name
-        case task_name
-        case client_name
-    }
-    
-    init(from decoder: Decoder) throws {
-        let container = try decoder.container(keyedBy: CodingKeys.self)
-        id = try container.decode(String.self, forKey: .id)
-        user_id = try container.decode(String.self, forKey: .user_id)
-        workspace_id = try container.decode(String.self, forKey: .workspace_id)
-        project_id = try container.decode(String.self, forKey: .project_id)
-        task_id = try container.decodeIfPresent(String.self, forKey: .task_id)
-        start_time = try container.decode(String.self, forKey: .start_time)
-        accumulated_seconds = try container.decode(Int.self, forKey: .accumulated_seconds)
-        
-        // Handle both Int and Bool for is_running
-        if let boolValue = try? container.decode(Bool.self, forKey: .is_running) {
-            is_running = boolValue
-        } else if let intValue = try? container.decode(Int.self, forKey: .is_running) {
-            is_running = intValue != 0
-        } else {
-            is_running = false
-        }
-        
-        project_name = try container.decodeIfPresent(String.self, forKey: .project_name)
-        task_name = try container.decodeIfPresent(String.self, forKey: .task_name)
-        client_name = try container.decodeIfPresent(String.self, forKey: .client_name)
-    }
-}
-
-// MARK: - Time Entry
-
-struct TimeEntry: Codable {
-    let id: String
-    let user_id: String
-    let workspace_id: String
-    let project_id: String
-    let task_id: String?
-    let start_time: String
-    let end_time: String
-    let duration: Int
-    let notes: String?
-}
-
-// MARK: - Login Response
-
-struct LoginResponse: Codable {
-    let token: String
-    let user: User
-}
-
-struct User: Codable {
-    let id: String
-    let email: String
-    let name: String
-}
-
-// MARK: - Workspace
-
-struct Workspace: Codable {
-    let id: String
-    let name: String
-    let owner_id: String
-    let role: String?
-}
-
-// MARK: - Error Response
-
-struct ErrorResponse: Codable {
-    let error: String
-}
diff --git a/menubar/ClockwizeMenuBar/StatusBarController.swift b/menubar/ClockwizeMenuBar/StatusBarController.swift
deleted file mode 100644
index 8863c5a..0000000
--- a/menubar/ClockwizeMenuBar/StatusBarController.swift
+++ /dev/null
@@ -1,297 +0,0 @@
-import Cocoa
-
-class StatusBarController {
-    
-    private var statusItem: NSStatusItem!
-    private var timer: Timer?
-    private var activeTimers: [ActiveTimer] = []
-    private var currentElapsed: Int = 0
-    private var displayTimer: Timer?
-    
-    init() {
-        setupStatusBar()
-        setupMenu()
-        startPolling()
-    }
-    
-    private func setupStatusBar() {
-        statusItem = NSStatusBar.system.statusItem(withLength: NSStatusItem.variableLength)
-        
-        if let button = statusItem.button {
-            updateStatusBarTitle(isRunning: false, elapsed: 0)
-        }
-    }
-    
-    private func updateStatusBarTitle(isRunning: Bool, elapsed: Int) {
-        guard let button = statusItem.button else { return }
-        
-        let hours = elapsed / 3600
-        let minutes = (elapsed % 3600) / 60
-        let seconds = elapsed % 60
-        
-        if isRunning {
-            // שעון ירוק כשהטיימר פועל
-            let timeString = String(format: "%d:%02d:%02d", hours, minutes, seconds)
-            button.title = "🟢 \(timeString)"
-        } else if elapsed > 0 {
-            // שעון צהוב כשמושהה
-            let timeString = String(format: "%d:%02d:%02d", hours, minutes, seconds)
-            button.title = "🟡 \(timeString)"
-        } else {
-            // שעון רגיל כשאין טיימר
-            button.title = "⏱️"
-        }
-    }
-    
-    private func setupMenu() {
-        let menu = NSMenu()
-        
-        // כותרת
-        let titleItem = NSMenuItem(title: "Clockwize", action: nil, keyEquivalent: "")
-        titleItem.isEnabled = false
-        menu.addItem(titleItem)
-        
-        menu.addItem(NSMenuItem.separator())
-        
-        // סטטוס טיימר (יתעדכן דינמית)
-        let statusItem = NSMenuItem(title: "אין טיימר פעיל", action: nil, keyEquivalent: "")
-        statusItem.tag = 100
-        statusItem.isEnabled = false
-        menu.addItem(statusItem)
-        
-        menu.addItem(NSMenuItem.separator())
-        
-        // פתיחת האפליקציה
-        let openAppItem = NSMenuItem(title: "📱 פתח Clockwize", action: #selector(openApp), keyEquivalent: "o")
-        openAppItem.target = self
-        menu.addItem(openAppItem)
-        
-        menu.addItem(NSMenuItem.separator())
-        
-        // התחברות/התנתקות
-        if AuthManager.shared.isLoggedIn {
-            let logoutItem = NSMenuItem(title: "🚪 התנתק", action: #selector(logout), keyEquivalent: "")
-            logoutItem.target = self
-            menu.addItem(logoutItem)
-        } else {
-            let loginItem = NSMenuItem(title: "🔐 התחבר", action: #selector(showLogin), keyEquivalent: "")
-            loginItem.target = self
-            menu.addItem(loginItem)
-        }
-        
-        menu.addItem(NSMenuItem.separator())
-        
-        // יציאה
-        let quitItem = NSMenuItem(title: "יציאה", action: #selector(quit), keyEquivalent: "q")
-        quitItem.target = self
-        menu.addItem(quitItem)
-        
-        self.statusItem.menu = menu
-    }
-    
-    private func startPolling() {
-        // עדכון מידי
-        fetchTimers()
-        
-        // עדכון כל 10 שניות
-        timer = Timer.scheduledTimer(withTimeInterval: 10.0, repeats: true) { [weak self] _ in
-            self?.fetchTimers()
-        }
-        
-        // עדכון התצוגה כל שנייה
-        displayTimer = Timer.scheduledTimer(withTimeInterval: 1.0, repeats: true) { [weak self] _ in
-            self?.updateDisplay()
-        }
-    }
-    
-    private func updateDisplay() {
-        guard let primaryTimer = activeTimers.first else {
-            updateStatusBarTitle(isRunning: false, elapsed: 0)
-            return
-        }
-        
-        if primaryTimer.is_running {
-            // חישוב זמן שעבר מאז start_time + accumulated_seconds
-            let startDate = ISO8601DateFormatter().date(from: primaryTimer.start_time) ?? Date()
-            let elapsed = primaryTimer.accumulated_seconds + Int(Date().timeIntervalSince(startDate))
-            currentElapsed = elapsed
-            updateStatusBarTitle(isRunning: true, elapsed: elapsed)
-        } else {
-            currentElapsed = primaryTimer.accumulated_seconds
-            updateStatusBarTitle(isRunning: false, elapsed: primaryTimer.accumulated_seconds)
-        }
-    }
-    
-    private func fetchTimers() {
-        guard AuthManager.shared.isLoggedIn else { return }
-        
-        TimerAPI.shared.getActiveTimers { [weak self] result in
-            DispatchQueue.main.async {
-                switch result {
-                case .success(let timers):
-                    self?.activeTimers = timers
-                    self?.updateMenu()
-                    self?.updateDisplay()
-                case .failure(let error):
-                    print("Error fetching timers: \(error)")
-                }
-            }
-        }
-    }
-    
-    private func updateMenu() {
-        guard let menu = statusItem.menu else { return }
-        
-        // מציאת פריט הסטטוס
-        guard let statusMenuItem = menu.item(withTag: 100) else { return }
-        
-        if let primaryTimer = activeTimers.first {
-            let projectName = primaryTimer.project_name ?? "פרויקט"
-            let taskName = primaryTimer.task_name
-            
-            var title = "⏱️ \(projectName)"
-            if let task = taskName {
-                title += " - \(task)"
-            }
-            
-            if primaryTimer.is_running {
-                title = "▶️ " + title.dropFirst(2)
-            } else {
-                title = "⏸️ " + title.dropFirst(2)
-            }
-            
-            statusMenuItem.title = title
-            
-            // הוספת כפתורי שליטה אם יש טיימר
-            addTimerControls(for: primaryTimer)
-        } else {
-            statusMenuItem.title = "אין טיימר פעיל"
-            removeTimerControls()
-        }
-    }
-    
-    private func addTimerControls(for timer: ActiveTimer) {
-        guard let menu = statusItem.menu else { return }
-        
-        // הסרת כפתורים קודמים
-        removeTimerControls()
-        
-        // מציאת מיקום להוספה (אחרי הסטטוס)
-        guard let statusIndex = menu.items.firstIndex(where: { $0.tag == 100 }) else { return }
-        
-        if timer.is_running {
-            // כפתור השהייה
-            let pauseItem = NSMenuItem(title: "⏸️ השהה", action: #selector(pauseTimer), keyEquivalent: "")
-            pauseItem.target = self
-            pauseItem.tag = 101
-            pauseItem.representedObject = timer.id
-            menu.insertItem(pauseItem, at: statusIndex + 1)
-        } else {
-            // כפתור המשך
-            let resumeItem = NSMenuItem(title: "▶️ המשך", action: #selector(resumeTimer), keyEquivalent: "")
-            resumeItem.target = self
-            resumeItem.tag = 101
-            resumeItem.representedObject = timer.id
-            menu.insertItem(resumeItem, at: statusIndex + 1)
-        }
-        
-        // כפתור עצירה
-        let stopItem = NSMenuItem(title: "⏹️ עצור ושמור", action: #selector(stopTimer), keyEquivalent: "")
-        stopItem.target = self
-        stopItem.tag = 102
-        stopItem.representedObject = timer.id
-        menu.insertItem(stopItem, at: statusIndex + 2)
-    }
-    
-    private func removeTimerControls() {
-        guard let menu = statusItem.menu else { return }
-        
-        // הסרת פריטים עם tags 101 ו-102
-        if let item = menu.item(withTag: 101) {
-            menu.removeItem(item)
-        }
-        if let item = menu.item(withTag: 102) {
-            menu.removeItem(item)
-        }
-    }
-    
-    // MARK: - Actions
-    
-    @objc private func openApp() {
-        if let url = URL(string: "http://localhost:5173") {
-            NSWorkspace.shared.open(url)
-        }
-    }
-    
-    @objc private func pauseTimer(_ sender: NSMenuItem) {
-        guard let timerId = sender.representedObject as? String else { return }
-        
-        TimerAPI.shared.pauseTimer(id: timerId) { [weak self] result in
-            DispatchQueue.main.async {
-                switch result {
-                case .success:
-                    self?.fetchTimers()
-                case .failure(let error):
-                    print("Error pausing timer: \(error)")
-                }
-            }
-        }
-    }
-    
-    @objc private func resumeTimer(_ sender: NSMenuItem) {
-        guard let timerId = sender.representedObject as? String else { return }
-        
-        TimerAPI.shared.resumeTimer(id: timerId) { [weak self] result in
-            DispatchQueue.main.async {
-                switch result {
-                case .success:
-                    self?.fetchTimers()
-                case .failure(let error):
-                    print("Error resuming timer: \(error)")
-                }
-            }
-        }
-    }
-    
-    @objc private func stopTimer(_ sender: NSMenuItem) {
-        guard let timerId = sender.representedObject as? String else { return }
-        
-        TimerAPI.shared.stopTimer(id: timerId) { [weak self] result in
-            DispatchQueue.main.async {
-                switch result {
-                case .success:
-                    self?.fetchTimers()
-                    // הצגת התראה
-                    self?.showNotification(title: "Clockwize", body: "הטיימר נשמר בהצלחה")
-                case .failure(let error):
-                    print("Error stopping timer: \(error)")
-                }
-            }
-        }
-    }
-    
-    @objc private func showLogin() {
-        if let appDelegate = NSApp.delegate as? AppDelegate {
-            appDelegate.showLoginWindow()
-        }
-    }
-    
-    @objc private func logout() {
-        AuthManager.shared.logout()
-        activeTimers = []
-        updateStatusBarTitle(isRunning: false, elapsed: 0)
-        setupMenu()
-    }
-    
-    @objc private func quit() {
-        NSApp.terminate(nil)
-    }
-    
-    private func showNotification(title: String, body: String) {
-        let notification = NSUserNotification()
-        notification.title = title
-        notification.informativeText = body
-        notification.soundName = NSUserNotificationDefaultSoundName
-        NSUserNotificationCenter.default.deliver(notification)
-    }
-}
diff --git a/menubar/ClockwizeMenuBar/TimerAPI.swift b/menubar/ClockwizeMenuBar/TimerAPI.swift
deleted file mode 100644
index b4c69ac..0000000
--- a/menubar/ClockwizeMenuBar/TimerAPI.swift
+++ /dev/null
@@ -1,276 +0,0 @@
-import Foundation
-
-class TimerAPI {
-    
-    static let shared = TimerAPI()
-    
-    private let baseURL = "http://localhost:3001/api"
-    
-    private init() {}
-    
-    // MARK: - Get Active Timers
-    
-    func getActiveTimers(completion: @escaping (Result<[ActiveTimer], Error>) -> Void) {
-        guard let token = AuthManager.shared.token,
-              let workspaceId = AuthManager.shared.workspaceId else {
-            completion(.failure(APIError.notAuthenticated))
-            return
-        }
-        
-        guard let url = URL(string: "\(baseURL)/timer/active") else {
-            completion(.failure(APIError.invalidURL))
-            return
-        }
-        
-        var request = URLRequest(url: url)
-        request.httpMethod = "GET"
-        request.setValue("Bearer \(token)", forHTTPHeaderField: "Authorization")
-        request.setValue(workspaceId, forHTTPHeaderField: "X-Workspace-Id")
-        request.setValue("application/json", forHTTPHeaderField: "Content-Type")
-        
-        URLSession.shared.dataTask(with: request) { data, response, error in
-            if let error = error {
-                completion(.failure(error))
-                return
-            }
-            
-            guard let data = data else {
-                completion(.failure(APIError.noData))
-                return
-            }
-            
-            do {
-                let timers = try JSONDecoder().decode([ActiveTimer].self, from: data)
-                completion(.success(timers))
-            } catch {
-                print("Decode error: \(error)")
-                completion(.failure(error))
-            }
-        }.resume()
-    }
-    
-    // MARK: - Pause Timer
-    
-    func pauseTimer(id: String, completion: @escaping (Result<ActiveTimer, Error>) -> Void) {
-        guard let token = AuthManager.shared.token,
-              let workspaceId = AuthManager.shared.workspaceId else {
-            completion(.failure(APIError.notAuthenticated))
-            return
-        }
-        
-        guard let url = URL(string: "\(baseURL)/timer/pause/\(id)") else {
-            completion(.failure(APIError.invalidURL))
-            return
-        }
-        
-        var request = URLRequest(url: url)
-        request.httpMethod = "POST"
-        request.setValue("Bearer \(token)", forHTTPHeaderField: "Authorization")
-        request.setValue(workspaceId, forHTTPHeaderField: "X-Workspace-Id")
-        request.setValue("application/json", forHTTPHeaderField: "Content-Type")
-        
-        URLSession.shared.dataTask(with: request) { data, response, error in
-            if let error = error {
-                completion(.failure(error))
-                return
-            }
-            
-            guard let data = data else {
-                completion(.failure(APIError.noData))
-                return
-            }
-            
-            do {
-                let timer = try JSONDecoder().decode(ActiveTimer.self, from: data)
-                completion(.success(timer))
-            } catch {
-                completion(.failure(error))
-            }
-        }.resume()
-    }
-    
-    // MARK: - Resume Timer
-    
-    func resumeTimer(id: String, completion: @escaping (Result<ActiveTimer, Error>) -> Void) {
-        guard let token = AuthManager.shared.token,
-              let workspaceId = AuthManager.shared.workspaceId else {
-            completion(.failure(APIError.notAuthenticated))
-            return
-        }
-        
-        guard let url = URL(string: "\(baseURL)/timer/resume/\(id)") else {
-            completion(.failure(APIError.invalidURL))
-            return
-        }
-        
-        var request = URLRequest(url: url)
-        request.httpMethod = "POST"
-        request.setValue("Bearer \(token)", forHTTPHeaderField: "Authorization")
-        request.setValue(workspaceId, forHTTPHeaderField: "X-Workspace-Id")
-        request.setValue("application/json", forHTTPHeaderField: "Content-Type")
-        
-        URLSession.shared.dataTask(with: request) { data, response, error in
-            if let error = error {
-                completion(.failure(error))
-                return
-            }
-            
-            guard let data = data else {
-                completion(.failure(APIError.noData))
-                return
-            }
-            
-            do {
-                let timer = try JSONDecoder().decode(ActiveTimer.self, from: data)
-                completion(.success(timer))
-            } catch {
-                completion(.failure(error))
-            }
-        }.resume()
-    }
-    
-    // MARK: - Stop Timer
-    
-    func stopTimer(id: String, notes: String? = nil, completion: @escaping (Result<TimeEntry, Error>) -> Void) {
-        guard let token = AuthManager.shared.token,
-              let workspaceId = AuthManager.shared.workspaceId else {
-            completion(.failure(APIError.notAuthenticated))
-            return
-        }
-        
-        guard let url = URL(string: "\(baseURL)/timer/stop/\(id)") else {
-            completion(.failure(APIError.invalidURL))
-            return
-        }
-        
-        var request = URLRequest(url: url)
-        request.httpMethod = "POST"
-        request.setValue("Bearer \(token)", forHTTPHeaderField: "Authorization")
-        request.setValue(workspaceId, forHTTPHeaderField: "X-Workspace-Id")
-        request.setValue("application/json", forHTTPHeaderField: "Content-Type")
-        
-        let body: [String: Any] = ["notes": notes ?? ""]
-        request.httpBody = try? JSONSerialization.data(withJSONObject: body)
-        
-        URLSession.shared.dataTask(with: request) { data, response, error in
-            if let error = error {
-                completion(.failure(error))
-                return
-            }
-            
-            guard let data = data else {
-                completion(.failure(APIError.noData))
-                return
-            }
-            
-            do {
-                let entry = try JSONDecoder().decode(TimeEntry.self, from: data)
-                completion(.success(entry))
-            } catch {
-                completion(.failure(error))
-            }
-        }.resume()
-    }
-    
-    // MARK: - Login
-    
-    func login(email: String, password: String, completion: @escaping (Result<LoginResponse, Error>) -> Void) {
-        guard let url = URL(string: "\(baseURL)/auth/login") else {
-            completion(.failure(APIError.invalidURL))
-            return
-        }
-        
-        var request = URLRequest(url: url)
-        request.httpMethod = "POST"
-        request.setValue("application/json", forHTTPHeaderField: "Content-Type")
-        
-        let body: [String: Any] = ["email": email, "password": password]
-        request.httpBody = try? JSONSerialization.data(withJSONObject: body)
-        
-        URLSession.shared.dataTask(with: request) { data, response, error in
-            if let error = error {
-                completion(.failure(error))
-                return
-            }
-            
-            guard let data = data else {
-                completion(.failure(APIError.noData))
-                return
-            }
-            
-            // בדיקת תגובת שגיאה
-            if let httpResponse = response as? HTTPURLResponse, httpResponse.statusCode != 200 {
-                if let errorResponse = try? JSONDecoder().decode(ErrorResponse.self, from: data) {
-                    completion(.failure(APIError.serverError(errorResponse.error)))
-                } else {
-                    completion(.failure(APIError.serverError("שגיאה בהתחברות")))
-                }
-                return
-            }
-            
-            do {
-                let loginResponse = try JSONDecoder().decode(LoginResponse.self, from: data)
-                completion(.success(loginResponse))
-            } catch {
-                print("Login decode error: \(error)")
-                completion(.failure(error))
-            }
-        }.resume()
-    }
-    
-    // MARK: - Get Workspaces
-    
-    func getWorkspaces(token: String, completion: @escaping (Result<[Workspace], Error>) -> Void) {
-        guard let url = URL(string: "\(baseURL)/workspaces") else {
-            completion(.failure(APIError.invalidURL))
-            return
-        }
-        
-        var request = URLRequest(url: url)
-        request.httpMethod = "GET"
-        request.setValue("Bearer \(token)", forHTTPHeaderField: "Authorization")
-        request.setValue("application/json", forHTTPHeaderField: "Content-Type")
-        
-        URLSession.shared.dataTask(with: request) { data, response, error in
-            if let error = error {
-                completion(.failure(error))
-                return
-            }
-            
-            guard let data = data else {
-                completion(.failure(APIError.noData))
-                return
-            }
-            
-            do {
-                let workspaces = try JSONDecoder().decode([Workspace].self, from: data)
-                completion(.success(workspaces))
-            } catch {
-                print("Workspaces decode error: \(error)")
-                completion(.failure(error))
-            }
-        }.resume()
-    }
-}
-
-// MARK: - API Errors
-
-enum APIError: LocalizedError {
-    case notAuthenticated
-    case invalidURL
-    case noData
-    case serverError(String)
-    
-    var errorDescription: String? {
-        switch self {
-        case .notAuthenticated:
-            return "לא מחובר"
-        case .invalidURL:
-            return "כתובת לא תקינה"
-        case .noData:
-            return "לא התקבל מידע"
-        case .serverError(let message):
-            return message
-        }
-    }
-}
diff --git a/menubar/README.md b/menubar/README.md
deleted file mode 100644
index 3a75db2..0000000
--- a/menubar/README.md
+++ /dev/null
@@ -1,94 +0,0 @@
-# Clockwize Menu Bar App
-
-אפליקציית Menu Bar עבור Clockwize - מציגה את סטטוס הטיימר בשורת התפריטים של macOS.
-
-## 🎯 תכונות
-
-- ⏱️ הצגת זמן הטיימר הפעיל בשורת התפריטים
-- 🟢 אינדיקטור סטטוס (פועל/מושהה/לא פעיל)
-- ▶️/⏸️ התחלה/השהיה של הטיימר
-- ⏹️ עצירה ושמירת הטיימר
-- 📱 פתיחה מהירה של האפליקציה הראשית
-
-## 📦 התקנה
-
-### דרישות מקדימות
-
-נדרש אחד מהבאים:
-
-**אפשרות א': Xcode (מומלץ)**
-1. התקן Xcode מה-[App Store](https://apps.apple.com/app/xcode/id497799835)
-2. פתח Terminal והרץ: `sudo xcode-select -s /Applications/Xcode.app`
-
-**אפשרות ב': עדכון Command Line Tools**
-```bash
-sudo rm -rf /Library/Developer/CommandLineTools
-xcode-select --install
-```
-
-### בנייה
-
-לאחר התקנת Xcode או עדכון CLT:
-
-```bash
-cd menubar
-./build.sh
-```
-
-האפליקציה תיבנה ותועתק ל: `ClockwizeMenuBar.app`
-
-### פתיחה ישירה ב-Xcode
-
-אם יש לך Xcode:
-1. פתח את הקובץ `ClockwizeMenuBar.xcodeproj`
-2. לחץ Cmd+B לבנייה
-3. לחץ Cmd+R להרצה
-
-## 🚀 הפעלה
-
-```bash
-open ../ClockwizeMenuBar.app
-```
-
-או לחץ פעמיים על `ClockwizeMenuBar.app` ב-Finder.
-
-## ⚙️ שימוש
-
-1. **התחברות ראשונית**: בפעם הראשונה תתבקש להתחבר עם האימייל והסיסמא של Clockwize
-2. **תפריט**: לחץ על האייקון בשורת התפריטים לפתיחת התפריט
-3. **שליטה בטיימר**: השתמש בכפתורים בתפריט להשהיה/המשך/עצירה
-
-## 📁 מבנה הקבצים
-
-```
-menubar/
-├── ClockwizeMenuBar/
-│   ├── AppDelegate.swift      # נקודת כניסה
-│   ├── StatusBarController.swift  # ניהול התפריט
-│   ├── TimerAPI.swift         # API client
-│   ├── Models.swift           # מודלים
-│   ├── AuthManager.swift      # ניהול התחברות
-│   ├── LoginViewController.swift  # חלון התחברות
-│   └── Info.plist             # הגדרות
-├── ClockwizeMenuBar.xcodeproj/
-├── build.sh
-└── README.md
-```
-
-## 🔧 פתרון בעיות
-
-### "SDK is not supported by the compiler"
-עדכן את Command Line Tools:
-```bash
-sudo rm -rf /Library/Developer/CommandLineTools
-xcode-select --install
-```
-
-### "xcodebuild requires Xcode"
-התקן Xcode מה-App Store והרץ:
-```bash
-sudo xcode-select -s /Applications/Xcode.app
-```
-
-### האפליקציה לא מתחברת ל-API
-ודא שהשרת של Clockwize רץ על `localhost:3001`
diff --git a/menubar/build.sh b/menubar/build.sh
deleted file mode 100755
index 99628c0..0000000
--- a/menubar/build.sh
+++ /dev/null
@@ -1,91 +0,0 @@
-#!/bin/bash
-
-# Clockwize Menu Bar - Build Script
-# This script compiles the Swift source files into a macOS app bundle
-
-set -e
-
-# צבעים להודעות
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-CYAN='\033[0;36m'
-NC='\033[0m' # No Color
-
-echo -e "${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
-echo -e "${CYAN}🔨 Building Clockwize Menu Bar${NC}"
-echo -e "${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
-
-# תיקיות
-SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-PROJECT_DIR="$SCRIPT_DIR/.."
-BUILD_DIR="$SCRIPT_DIR/build"
-APP_NAME="ClockwizeMenuBar"
-
-# בדיקה אם xcodebuild זמין
-if command -v xcodebuild &> /dev/null; then
-    echo -e "${YELLOW}📦 Building with xcodebuild...${NC}"
-    
-    cd "$SCRIPT_DIR"
-    
-    xcodebuild -project ClockwizeMenuBar.xcodeproj \
-        -scheme ClockwizeMenuBar \
-        -configuration Release \
-        -derivedDataPath "$BUILD_DIR" \
-        build 2>&1 | while read line; do
-            # סינון פלט לקריאות
-            if [[ "$line" == *"error:"* ]]; then
-                echo -e "${RED}$line${NC}"
-            elif [[ "$line" == *"warning:"* ]]; then
-                echo -e "${YELLOW}$line${NC}"
-            elif [[ "$line" == *"BUILD SUCCEEDED"* ]]; then
-                echo -e "${GREEN}$line${NC}"
-            elif [[ "$line" == *"BUILD FAILED"* ]]; then
-                echo -e "${RED}$line${NC}"
-            fi
-        done
-    
-    # מציאת האפליקציה שנבנתה
-    BUILT_APP=$(find "$BUILD_DIR" -name "ClockwizeMenuBar.app" -type d | head -1)
-    
-    if [ -d "$BUILT_APP" ]; then
-        echo -e "${GREEN}✓ Build successful${NC}"
-        
-        # העתקה לתיקיית הפרויקט
-        rm -rf "$PROJECT_DIR/ClockwizeMenuBar.app"
-        cp -R "$BUILT_APP" "$PROJECT_DIR/ClockwizeMenuBar.app"
-        
-        echo ""
-        echo -e "${GREEN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
-        echo -e "${GREEN}✅ Build completed successfully!${NC}"
-        echo -e "${GREEN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
-        echo ""
-        echo -e "App location: ${YELLOW}$PROJECT_DIR/ClockwizeMenuBar.app${NC}"
-        echo ""
-        echo -e "To run: ${CYAN}open \"$PROJECT_DIR/ClockwizeMenuBar.app\"${NC}"
-        exit 0
-    else
-        echo -e "${RED}✗ Could not find built app${NC}"
-        exit 1
-    fi
-else
-    echo -e "${RED}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
-    echo -e "${RED}❌ xcodebuild not found${NC}"
-    echo -e "${RED}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
-    echo ""
-    echo -e "To build the Menu Bar app, you need one of the following:"
-    echo ""
-    echo -e "${YELLOW}Option 1: Install Xcode from the App Store${NC}"
-    echo -e "  After installing, run this script again."
-    echo ""
-    echo -e "${YELLOW}Option 2: Update Command Line Tools${NC}"
-    echo -e "  Run these commands:"
-    echo -e "  ${CYAN}sudo rm -rf /Library/Developer/CommandLineTools${NC}"
-    echo -e "  ${CYAN}xcode-select --install${NC}"
-    echo ""
-    echo -e "${YELLOW}Option 3: Open the Xcode project manually${NC}"
-    echo -e "  Open: ${CYAN}$SCRIPT_DIR/ClockwizeMenuBar.xcodeproj${NC}"
-    echo -e "  Then press Cmd+B to build"
-    echo ""
-    exit 1
-fi
diff --git a/server/database.js b/server/database.js
index db19319..5fb2c38 100644
--- a/server/database.js
+++ b/server/database.js
@@ -135,6 +135,135 @@ class Database {
   }
 }
 
+// user_addons table definition. Addons are switched on and off per workspace (every route reads and
+// writes by workspace_id + addon_id), so that pair is the unique key.
+function userAddonsTableSql(name) {
+  return `CREATE TABLE ${name} (
+      id TEXT PRIMARY KEY,
+      user_id TEXT NOT NULL,
+      workspace_id TEXT,
+      addon_id TEXT NOT NULL,
+      is_enabled INTEGER DEFAULT 1,
+      created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+      updated_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+      FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
+      UNIQUE(workspace_id, addon_id)
+    )`;
+}
+
+const USER_ADDONS_COLUMNS = ['id', 'user_id', 'workspace_id', 'addon_id', 'is_enabled', 'created_at', 'updated_at'];
+
+// integrations table definition. A connection (e.g. Morning) belongs to the workspace - every route
+// reads, writes and disconnects by workspace_id + provider; user_id is who connected it.
+function integrationsTableSql(name) {
+  return `CREATE TABLE ${name} (
+      id TEXT PRIMARY KEY,
+      user_id TEXT NOT NULL,
+      workspace_id TEXT,
+      provider TEXT NOT NULL,
+      api_key TEXT,
+      api_secret TEXT,
+      access_token TEXT,
+      refresh_token TEXT,
+      expires_at DATETIME,
+      settings TEXT,
+      is_active INTEGER DEFAULT 1,
+      created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+      updated_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+      FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
+      UNIQUE(workspace_id, provider)
+    )`;
+}
+
+const INTEGRATIONS_COLUMNS = [
+  'id', 'user_id', 'workspace_id', 'provider', 'api_key', 'api_secret', 'access_token', 'refresh_token',
+  'expires_at', 'settings', 'is_active', 'created_at', 'updated_at'
+];
+
+// Rebuilds `table` so its unique key is `newKey` instead of `oldKey`, keeping every row:
+// CREATE <table>_new -> INSERT SELECT -> check the row count -> DROP old -> RENAME, all in one
+// transaction. Runs only while the old key is there, so it is safe on every start. Any failure
+// (e.g. rows that would break the new key) rolls back and leaves the old table exactly as it was.
+function rebuildWithUniqueKey(db, { table, oldKey, newKey, tableSql, knownColumns }) {
+  const uniqueKeys = db.prepare(`SELECT name FROM pragma_index_list(?) WHERE "unique" = 1`).all(table)
+    .map(index => db.prepare('SELECT name FROM pragma_index_info(?) ORDER BY seqno').all(index.name).map(col => col.name));
+  const hasOldKey = uniqueKeys.some(cols => cols.length === oldKey.length && cols.every((col, i) => col === oldKey[i]));
+  if (!hasOldKey) return false;
+
+  const label = `${table} unique key`;
+  const columns = db.prepare('SELECT name FROM pragma_table_info(?)').all(table).map(col => col.name);
+  const unexpected = columns.filter(col => !knownColumns.includes(col));
+  if (!newKey.every(col => columns.includes(col)) || unexpected.length > 0) {
+    console.error(`Migration skipped (${label}): unexpected columns [${columns.join(', ')}] - table left as is`);
+    return false;
+  }
+
+  const columnList = columns.join(', ');
+  const before = db.prepare(`SELECT COUNT(*) AS n FROM ${table}`).get().n;
+  // Kept synchronous on purpose: the file is written on a later tick (save() -> setImmediate),
+  // and writing it (export()) would end an open transaction
+  try {
+    db.exec('BEGIN');
+    db.exec(`DROP TABLE IF EXISTS ${table}_new`);
+    db.exec(tableSql(`${table}_new`));
+    db.exec(`INSERT INTO ${table}_new (${columnList}) SELECT ${columnList} FROM ${table}`);
+    const copied = db.prepare(`SELECT COUNT(*) AS n FROM ${table}_new`).get().n;
+    if (copied !== before) throw new Error(`row count mismatch: ${before} -> ${copied}`);
+    db.exec(`DROP TABLE ${table}`);
+    db.exec(`ALTER TABLE ${table}_new RENAME TO ${table}`);
+    db.exec('COMMIT');
+    console.log(`✅ Migrated ${table} to UNIQUE(${newKey.join(', ')}) (${copied} rows kept)`);
+    return true;
+  } catch (e) {
+    try { db.exec('ROLLBACK'); } catch { /* nothing to roll back */ }
+    console.error(`Migration error (${label}) - old table kept:`, e.message);
+    return false;
+  }
+}
+
+// Older databases have user_addons with UNIQUE(user_id, addon_id): a member of two workspaces got a
+// 500 the first time they toggled an addon in the second one
+export function migrateUserAddonsUniqueKey(db) {
+  return rebuildWithUniqueKey(db, {
+    table: 'user_addons',
+    oldKey: ['user_id', 'addon_id'],
+    newKey: ['workspace_id', 'addon_id'],
+    tableSql: userAddonsTableSql,
+    knownColumns: USER_ADDONS_COLUMNS
+  });
+}
+
+// Older databases have integrations with UNIQUE(user_id, provider): connecting Morning in a second
+// workspace failed for a user who had already connected it in another one
+export function migrateIntegrationsUniqueKey(db) {
+  return rebuildWithUniqueKey(db, {
+    table: 'integrations',
+    oldKey: ['user_id', 'provider'],
+    newKey: ['workspace_id', 'provider'],
+    tableSql: integrationsTableSql,
+    knownColumns: INTEGRATIONS_COLUMNS
+  });
+}
+
+// Monthly/yearly reminders remember the day of the month they were set for, so a reminder on the 31st
+// goes 31.1 -> 28.2 -> 31.3 instead of drifting to the 28th. The day is read in local time, exactly
+// like routes/reminders.js reschedules. Fills only reminders that have no anchor yet (idempotent).
+export function backfillReminderRecurrenceDay(db) {
+  const unanchored = db.prepare(`
+    SELECT id, due_date FROM reminders
+    WHERE recurrence_day IS NULL AND is_recurring = 1 AND recurrence_interval IN ('monthly', 'yearly') AND due_date IS NOT NULL
+  `).all();
+  let filled = 0;
+  for (const reminder of unanchored) {
+    const due = new Date(reminder.due_date);
+    if (Number.isNaN(due.getTime())) continue;
+    db.prepare('UPDATE reminders SET recurrence_day = ? WHERE id = ? AND recurrence_day IS NULL').run(due.getDate(), reminder.id);
+    filled += 1;
+  }
+  if (filled > 0) console.log(`✅ Anchored ${filled} monthly/yearly reminders to their day of the month`);
+  return filled;
+}
+
 async function initDatabase() {
   const SQL = await initSqlJs();
 
@@ -344,23 +473,8 @@ async function initDatabase() {
       FOREIGN KEY (task_id) REFERENCES tasks(id) ON DELETE CASCADE
     );
 
-    -- Integrations table
-    CREATE TABLE IF NOT EXISTS integrations (
-      id TEXT PRIMARY KEY,
-      user_id TEXT NOT NULL,
-      provider TEXT NOT NULL,
-      api_key TEXT,
-      api_secret TEXT,
-      access_token TEXT,
-      refresh_token TEXT,
-      expires_at DATETIME,
-      settings TEXT,
-      is_active INTEGER DEFAULT 1,
-      created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
-      updated_at DATETIME DEFAULT CURRENT_TIMESTAMP,
-      FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
-      UNIQUE(user_id, provider)
-    );
+    -- Integrations table (one connection per provider per workspace; user_id = who connected it)
+    ${integrationsTableSql('IF NOT EXISTS integrations')};
 
     -- Payments table
     CREATE TABLE IF NOT EXISTS payments (
@@ -422,17 +536,8 @@ async function initDatabase() {
       FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
     );
 
-    -- User Addons table (stores which addons are enabled/disabled per user)
-    CREATE TABLE IF NOT EXISTS user_addons (
-      id TEXT PRIMARY KEY,
-      user_id TEXT NOT NULL,
-      addon_id TEXT NOT NULL,
-      is_enabled INTEGER DEFAULT 1,
-      created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
-      updated_at DATETIME DEFAULT CURRENT_TIMESTAMP,
-      FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
-      UNIQUE(user_id, addon_id)
-    );
+    -- User Addons table (which addons are enabled/disabled per workspace; user_id = who set it)
+    ${userAddonsTableSql('IF NOT EXISTS user_addons')};
 
     -- Comment read status table (tracks when user last viewed comments for each context)
     CREATE TABLE IF NOT EXISTS comment_read_status (
@@ -544,6 +649,9 @@ async function initDatabase() {
 
   // Migration: Add force_password_reset column to users
   db.addColumn('users', 'force_password_reset', 'INTEGER DEFAULT 0');
+  // Session tokens issued before this time (ms since epoch) are refused - set when the admin forces
+  // a password reset, so sessions from before it never come back (middleware/auth.js)
+  db.addColumn('users', 'sessions_valid_after', 'INTEGER');
 
   // Migration: Add status column to clients
   db.addColumn('clients', 'status', "TEXT DEFAULT 'active'");
@@ -590,6 +698,14 @@ async function initDatabase() {
   // Migration: Add is_archived column to reminders table (separate from is_read/handled)
   db.addColumn('reminders', 'is_archived', 'INTEGER DEFAULT 0');
 
+  // Migration: Add recurrence_day to reminders (the day of the month a monthly/yearly reminder keeps)
+  db.addColumn('reminders', 'recurrence_day', 'INTEGER');
+  try {
+    backfillReminderRecurrenceDay(db);
+  } catch (e) {
+    console.error('Migration error (reminders recurrence_day):', e.message);
+  }
+
   // Migration: Add new subtask fields (due_date, description, priority)
   db.addColumn('subtasks', 'due_date', 'TEXT');
   db.addColumn('subtasks', 'description', 'TEXT');
@@ -611,6 +727,10 @@ async function initDatabase() {
     db.addColumn(table, 'workspace_id', 'TEXT');
   }
 
+  // Migration: user_addons and integrations are keyed per workspace, not per user (need workspace_id, added above)
+  migrateUserAddonsUniqueKey(db);
+  migrateIntegrationsUniqueKey(db);
+
   // Migration: Create personal workspace for existing users who don't have one
   try {
     const usersWithoutWorkspace = db.prepare(`
@@ -1184,6 +1304,9 @@ async function initDatabase() {
   return db;
 }
 
+// The wrapper class is exported so migrations can be tested against a throwaway database
+export { Database };
+
 // Export a promise that resolves to the database
 export const dbPromise = initDatabase();
 export default dbPromise;
diff --git a/server/middleware/auth.js b/server/middleware/auth.js
index b9af312..427cfd4 100644
--- a/server/middleware/auth.js
+++ b/server/middleware/auth.js
@@ -6,8 +6,27 @@ if (!JWT_SECRET || JWT_SECRET.length < 32) {
   throw new Error('JWT_SECRET must be set in the environment and be at least 32 characters long');
 }
 
+// iatMs: issue time in ms (the standard iat is whole seconds), compared with users.sessions_valid_after
 export const generateToken = (userId) => {
-  return jwt.sign({ userId }, JWT_SECRET, { expiresIn: '30d' });
+  return jwt.sign({ userId, iatMs: Date.now() }, JWT_SECRET, { expiresIn: '30d' });
+};
+
+// A user the admin flagged for a forced password reset gets this instead of a session token: it is
+// accepted only by POST /api/auth/reset-password (authMiddleware rejects any token with a purpose)
+const PASSWORD_RESET_PURPOSE = 'password-reset';
+export const PASSWORD_RESET_TOKEN_TTL = '15m';
+
+export const generatePasswordResetToken = (userId) =>
+  jwt.sign({ userId, purpose: PASSWORD_RESET_PURPOSE }, JWT_SECRET, { expiresIn: PASSWORD_RESET_TOKEN_TTL });
+
+// The user id of a valid, unexpired password-reset token, or null
+export const verifyPasswordResetToken = (token) => {
+  try {
+    const decoded = jwt.verify(token, JWT_SECRET);
+    return decoded.purpose === PASSWORD_RESET_PURPOSE && decoded.userId ? decoded.userId : null;
+  } catch {
+    return null;
+  }
 };
 
 export const authMiddleware = (req, res, next) => {
@@ -26,11 +45,20 @@ export const authMiddleware = (req, res, next) => {
     return res.status(401).json({ error: 'טוקן לא תקין' });
   }
 
+  // Special-purpose tokens (a password-reset token) are not sessions
+  if (decoded.purpose) {
+    return res.status(401).json({ error: 'טוקן לא תקין' });
+  }
+
   // A valid signature is not enough: deleted or suspended users lose access right away,
-  // not when their 30-day token expires. 401 makes the client sign out.
+  // not when their 30-day token expires - and so does a user flagged for a forced password
+  // reset, until they set the new password. 401 makes the client sign out.
+  // Tokens issued before sessions_valid_after (the admin forced a password reset) are revoked.
   const db = req.app?.locals?.db;
-  const user = db?.prepare('SELECT is_active FROM users WHERE id = ?').get(decoded.userId);
-  if (db && (!user || user.is_active === 0)) {
+  const user = db?.prepare('SELECT is_active, force_password_reset, sessions_valid_after FROM users WHERE id = ?').get(decoded.userId);
+  const issuedAt = decoded.iatMs ?? (decoded.iat || 0) * 1000;
+  if (db && (!user || user.is_active === 0 || user.force_password_reset === 1 ||
+      (user.sessions_valid_after && issuedAt < user.sessions_valid_after))) {
     return res.status(401).json({ error: 'אנא התחבר למערכת' });
   }
 
diff --git a/server/middleware/rateLimit.js b/server/middleware/rateLimit.js
new file mode 100644
index 0000000..5728657
--- /dev/null
+++ b/server/middleware/rateLimit.js
@@ -0,0 +1,59 @@
+// Small in-memory rate limiter for the sign-in endpoints (one server process, no extra packages).
+//
+// Off when NODE_ENV is 'test' (the unit and e2e suites sign in constantly) unless
+// CLOCKWIZE_RATE_LIMIT=on; CLOCKWIZE_RATE_LIMIT=off turns it off anywhere. Both are read on every
+// request, so a test can switch it on for itself.
+const isEnabled = () => {
+  const flag = process.env.CLOCKWIZE_RATE_LIMIT;
+  if (flag === 'on') return true;
+  if (flag === 'off') return false;
+  return process.env.NODE_ENV !== 'test';
+};
+
+export const RATE_LIMIT_MESSAGE = 'יותר מדי ניסיונות. נסו שוב בעוד כמה דקות.';
+
+// key(req) names the bucket (e.g. IP + email). With failuresOnly, only responses with status >= 400
+// count and a successful one clears the bucket - a user who signs in fine is never locked out.
+export function createRateLimiter({ max = 10, windowMs = 15 * 60 * 1000, key = (req) => req.ip, failuresOnly = false } = {}) {
+  const buckets = new Map();
+
+  const sweep = (now) => {
+    for (const [k, bucket] of buckets) {
+      if (bucket.resetAt <= now) buckets.delete(k);
+    }
+  };
+
+  const limiter = (req, res, next) => {
+    if (!isEnabled()) return next();
+
+    const now = Date.now();
+    if (buckets.size > 10_000) sweep(now);
+    const k = String(key(req));
+    let bucket = buckets.get(k);
+    if (!bucket || bucket.resetAt <= now) {
+      bucket = { count: 0, resetAt: now + windowMs };
+      buckets.set(k, bucket);
+    }
+
+    if (bucket.count >= max) {
+      res.set('Retry-After', String(Math.ceil((bucket.resetAt - now) / 1000)));
+      return res.status(429).json({ error: RATE_LIMIT_MESSAGE });
+    }
+
+    if (!failuresOnly) {
+      bucket.count += 1;
+    } else {
+      res.on('finish', () => {
+        if (res.statusCode >= 400) bucket.count += 1;
+        else buckets.delete(k);
+      });
+    }
+    next();
+  };
+
+  limiter.reset = () => buckets.clear();
+  return limiter;
+}
+
+// "ip|identifier" - the identifier lower-cased so "Dana@x" and "dana@x" share a bucket
+export const ipAnd = (identifier) => (req) => `${req.ip}|${String(identifier(req) ?? '').trim().toLowerCase()}`;
diff --git a/server/routes/addons.js b/server/routes/addons.js
index 1e34837..c95f54a 100644
--- a/server/routes/addons.js
+++ b/server/routes/addons.js
@@ -1,6 +1,6 @@
 import express from 'express';
 import { v4 as uuidv4 } from 'uuid';
-import { authMiddleware, workspaceMiddleware } from '../middleware/auth.js';
+import { authMiddleware, workspaceMiddleware, canManageWorkspace } from '../middleware/auth.js';
 import { encrypt, decryptDetailed } from '../utils/crypto.js';
 
 const router = express.Router();
@@ -11,6 +11,14 @@ const SENSITIVE_SETTINGS = ['openai_api_key', 'api_key', 'api_secret', 'password
 // Helper to get db
 const getDb = (req) => req.app.locals.db;
 
+// הפעלה/כיבוי של תוספים והגדרותיהם (כולל מפתחות API) חלים על כל ה-workspace - רק בעלים או מנהל
+const requireAddonManager = (req, res, next) => {
+  if (!canManageWorkspace(req)) {
+    return res.status(403).json({ error: 'רק הבעלים או מנהל ה-workspace יכולים לשנות תוספים' });
+  }
+  next();
+};
+
 // הגדרת התוספים הזמינים במערכת
 // כל תוסף חדש צריך להתווסף כאן
 export const AVAILABLE_ADDONS = [
@@ -142,7 +150,7 @@ router.get('/enabled', authMiddleware, workspaceMiddleware, (req, res) => {
 });
 
 // עדכון מצב תוסף (הפעלה/כיבוי)
-router.put('/:addonId', authMiddleware, workspaceMiddleware, (req, res) => {
+router.put('/:addonId', authMiddleware, workspaceMiddleware, requireAddonManager, (req, res) => {
   try {
     const db = getDb(req);
     const { addonId } = req.params;
@@ -183,7 +191,7 @@ router.put('/:addonId', authMiddleware, workspaceMiddleware, (req, res) => {
 });
 
 // עדכון מרובה של תוספים
-router.put('/', authMiddleware, workspaceMiddleware, (req, res) => {
+router.put('/', authMiddleware, workspaceMiddleware, requireAddonManager, (req, res) => {
   try {
     const db = getDb(req);
     const { addons } = req.body; // מערך של { id, isEnabled }
@@ -287,6 +295,8 @@ router.get('/:addonId/settings', authMiddleware, workspaceMiddleware, (req, res)
     `).all(req.workspaceId, addonId);
     
     // המרה לאובייקט עם פענוח ומיסוך של ערכים רגישים
+    // חבר צוות רגיל רואה רק אם ערך רגיש מוגדר - גם הגרסה הממוסכת חושפת חלק מהמפתח
+    const canSeeMasked = canManageWorkspace(req);
     const result = {};
     for (const setting of settings) {
       const isSensitive = SENSITIVE_SETTINGS.some(s => setting.setting_key.includes(s));
@@ -295,7 +305,7 @@ router.get('/:addonId/settings', authMiddleware, workspaceMiddleware, (req, res)
         // פענוח הערך המוצפן
         const decrypted = decryptSetting(db, req.workspaceId, req.userId, addonId, setting.setting_key, setting.setting_value);
         // מיסוך לתצוגה
-        result[setting.setting_key] = maskSensitiveValue(decrypted);
+        if (canSeeMasked) result[setting.setting_key] = maskSensitiveValue(decrypted);
         // שליחת דגל שיש ערך מוגדר
         result[`${setting.setting_key}_configured`] = !!decrypted;
       } else {
@@ -311,7 +321,7 @@ router.get('/:addonId/settings', authMiddleware, workspaceMiddleware, (req, res)
 });
 
 // עדכון הגדרות תוסף
-router.put('/:addonId/settings', authMiddleware, workspaceMiddleware, (req, res) => {
+router.put('/:addonId/settings', authMiddleware, workspaceMiddleware, requireAddonManager, (req, res) => {
   try {
     const db = getDb(req);
     const { addonId } = req.params;
diff --git a/server/routes/admin.js b/server/routes/admin.js
index 797015c..7db9136 100644
--- a/server/routes/admin.js
+++ b/server/routes/admin.js
@@ -1,6 +1,7 @@
 import express from 'express';
 import { generateToken, authMiddleware } from '../middleware/auth.js';
 import bcrypt from 'bcryptjs';
+import { deleteUserAccount } from './workspaces.js';
 
 const router = express.Router();
 
@@ -52,6 +53,11 @@ router.post('/impersonate/:userId', (req, res) => {
     if (!user) {
       return res.status(404).json({ error: 'משתמש לא נמצא' });
     }
+
+    // Such a user's session tokens are refused until they set a new password (authMiddleware)
+    if (user.force_password_reset === 1) {
+      return res.status(409).json({ error: 'המשתמש נדרש להגדיר סיסמה חדשה - לא ניתן להתחבר בשמו עד שיעשה זאת' });
+    }
     
     const token = generateToken(user.id);
     
@@ -87,7 +93,8 @@ router.post('/users/:userId/force-password-reset', (req, res) => {
       return res.status(403).json({ error: 'לא ניתן לאפס סיסמת אדמין' });
     }
     
-    db.prepare('UPDATE users SET force_password_reset = 1 WHERE id = ?').run(userId);
+    // Also ends every session the user has now: they come back only through the reset
+    db.prepare('UPDATE users SET force_password_reset = 1, sessions_valid_after = ? WHERE id = ?').run(Date.now(), userId);
     
     res.json({ message: 'המשתמש יידרש לשנות סיסמה בהתחברות הבאה' });
   } catch (error) {
@@ -118,7 +125,9 @@ router.post('/users/:userId/set-password', async (req, res) => {
     }
     
     const hashedPassword = await bcrypt.hash(password, 10);
-    db.prepare('UPDATE users SET password = ?, force_password_reset = 0 WHERE id = ?').run(hashedPassword, userId);
+    // A password set by the admin also signs the user out everywhere
+    db.prepare('UPDATE users SET password = ?, force_password_reset = 0, sessions_valid_after = ? WHERE id = ?')
+      .run(hashedPassword, Date.now(), userId);
     
     res.json({ message: 'סיסמה שונתה בהצלחה' });
   } catch (error) {
@@ -172,8 +181,8 @@ router.delete('/users/:userId', (req, res) => {
       return res.status(403).json({ error: 'לא ניתן למחוק חשבון אדמין' });
     }
     
-    // Delete user (CASCADE will handle related records)
-    db.prepare('DELETE FROM users WHERE id = ?').run(userId);
+    // Personal workspaces go with the account; what the user created in shared workspaces stays there
+    deleteUserAccount(db, userId);
     
     res.json({ message: 'חשבון נמחק בהצלחה' });
   } catch (error) {
diff --git a/server/routes/auth.js b/server/routes/auth.js
index 8e73693..5613884 100644
--- a/server/routes/auth.js
+++ b/server/routes/auth.js
@@ -1,11 +1,28 @@
 import { Router } from 'express';
 import bcrypt from 'bcryptjs';
+import jwt from 'jsonwebtoken';
 import { v4 as uuidv4 } from 'uuid';
-import { generateToken, authMiddleware } from '../middleware/auth.js';
+import { generateToken, authMiddleware, verifyPasswordResetToken } from '../middleware/auth.js';
+import { createRateLimiter, ipAnd } from '../middleware/rateLimit.js';
 import { saveLocalSession, clearLocalSession } from '../utils/localSession.js';
+import { buildAuthResponse, buildPasswordResetRequiredResponse } from '../utils/authSession.js';
+import { deleteUserAccount } from './workspaces.js';
 
 const router = Router();
 
+// Failed sign-in / reset attempts per IP + account; a successful one clears the count
+const loginLimiter = createRateLimiter({ max: 10, failuresOnly: true, key: ipAnd((req) => req.body?.email) });
+// The account is read from the reset token without verifying it (that happens in the route): garbage
+// tokens all share one bucket, so they can't lock real users out of their reset
+const resetTokenUserId = (req) => {
+  try {
+    return jwt.decode(req.body?.resetToken)?.userId || '';
+  } catch {
+    return '';
+  }
+};
+const resetLimiter = createRateLimiter({ max: 10, failuresOnly: true, key: ipAnd(resetTokenUserId) });
+
 // Helper to get db from app
 const getDb = (req) => req.app.locals.db;
 
@@ -70,7 +87,7 @@ router.post('/register', async (req, res) => {
 });
 
 // Login
-router.post('/login', async (req, res) => {
+router.post('/login', loginLimiter, async (req, res) => {
   try {
     const db = getDb(req);
     const { email, password } = req.body;
@@ -99,40 +116,13 @@ router.post('/login', async (req, res) => {
       return res.status(401).json({ error: 'אימייל או סיסמה שגויים' });
     }
 
-    const token = generateToken(user.id);
-
-    // Check if password reset is required - allow login but flag it
-    const requiresPasswordReset = user.force_password_reset === 1;
-
-    // Get user's workspaces
-    const workspaces = db.prepare(`
-      SELECT w.*, wm.role,
-        (SELECT COUNT(*) FROM workspace_members WHERE workspace_id = w.id) as member_count
-      FROM workspaces w
-      JOIN workspace_members wm ON w.id = wm.workspace_id
-      WHERE wm.user_id = ?
-      ORDER BY wm.joined_at ASC
-    `).all(user.id);
-
-    // Save session locally for desktop apps (Menu Bar)
-    const currentWorkspace = workspaces[0] || null;
-    if (currentWorkspace) {
-      saveLocalSession(token, currentWorkspace.id);
+    // Flagged by the admin: no session until the new password is set (POST /reset-password)
+    if (user.force_password_reset === 1) {
+      return res.json(buildPasswordResetRequiredResponse(user));
     }
 
-    res.json({
-      user: {
-        id: user.id,
-        email: user.email,
-        name: user.name,
-        default_hourly_rate: user.default_hourly_rate,
-        is_admin: user.is_admin || 0
-      },
-      token,
-      requiresPasswordReset,
-      workspaces,
-      currentWorkspace
-    });
+    // Also saves the session locally for the desktop apps (Menu Bar)
+    res.json(buildAuthResponse(db, user));
   } catch (error) {
     console.error('Login error:', error);
     res.status(500).json({ error: 'שגיאה בהתחברות' });
@@ -160,7 +150,12 @@ router.post('/desktop-handoff', authMiddleware, (req, res) => {
 router.get('/me', authMiddleware, (req, res) => {
   try {
     const db = getDb(req);
-    const user = db.prepare('SELECT id, email, name, default_hourly_rate, is_admin, created_at FROM users WHERE id = ?').get(req.userId);
+    // has_password: 0 for passkey-only accounts (they confirm destructive actions with their email)
+    const user = db.prepare(`
+      SELECT id, email, name, default_hourly_rate, is_admin, created_at,
+        CASE WHEN password IS NOT NULL AND password != '' THEN 1 ELSE 0 END AS has_password
+      FROM users WHERE id = ?
+    `).get(req.userId);
     if (!user) {
       return res.status(404).json({ error: 'משתמש לא נמצא' });
     }
@@ -194,14 +189,17 @@ router.put('/profile', authMiddleware, async (req, res) => {
 
     const user = db.prepare('SELECT * FROM users WHERE id = ?').get(req.userId);
     
-    // If changing password, verify current password
+    // Changing the password needs the current one - except on a passkey-only account (no stored
+    // password), which sets its first password here
     if (password) {
-      if (!currentPassword) {
-        return res.status(400).json({ error: 'נדרשת סיסמה נוכחית' });
-      }
-      const validPassword = await bcrypt.compare(currentPassword, user.password);
-      if (!validPassword) {
-        return res.status(401).json({ error: 'סיסמה נוכחית שגויה' });
+      if (user.password) {
+        if (!currentPassword) {
+          return res.status(400).json({ error: 'נדרשת סיסמה נוכחית' });
+        }
+        const validPassword = await bcrypt.compare(currentPassword, user.password);
+        if (!validPassword) {
+          return res.status(401).json({ error: 'סיסמה נוכחית שגויה' });
+        }
       }
     }
 
@@ -223,14 +221,34 @@ router.put('/profile', authMiddleware, async (req, res) => {
       const hashedPassword = await bcrypt.hash(password, 10);
       updates.push('password = ?'); 
       params.push(hashedPassword); 
+      // A new password signs out every other session (tokens issued before now, middleware/auth.js)
+      updates.push('sessions_valid_after = ?');
+      params.push(Date.now());
     }
     updates.push('updated_at = CURRENT_TIMESTAMP');
     params.push(req.userId);
 
     db.prepare(`UPDATE users SET ${updates.join(', ')} WHERE id = ?`).run(...params);
 
-    const updatedUser = db.prepare('SELECT id, email, name, default_hourly_rate FROM users WHERE id = ?').get(req.userId);
-    res.json(updatedUser);
+    const updatedUser = db.prepare(`
+      SELECT id, email, name, default_hourly_rate,
+        CASE WHEN password IS NOT NULL AND password != '' THEN 1 ELSE 0 END AS has_password
+      FROM users WHERE id = ?
+    `).get(req.userId);
+
+    if (!password) {
+      return res.json(updatedUser);
+    }
+
+    // ... but keeps this one: a fresh token for the client, and for the desktop / menu-bar app
+    const token = generateToken(req.userId);
+    const requested = req.headers['x-workspace-id'];
+    const membership = (requested && db.prepare('SELECT workspace_id FROM workspace_members WHERE workspace_id = ? AND user_id = ?').get(requested, req.userId))
+      || db.prepare('SELECT workspace_id FROM workspace_members WHERE user_id = ? ORDER BY joined_at ASC LIMIT 1').get(req.userId);
+    if (membership) {
+      saveLocalSession(token, membership.workspace_id);
+    }
+    res.json({ ...updatedUser, token });
   } catch (error) {
     console.error('Update profile error:', error);
     res.status(500).json({ error: 'שגיאה בעדכון הפרופיל' });
@@ -241,20 +259,29 @@ router.put('/profile', authMiddleware, async (req, res) => {
 router.delete('/account', authMiddleware, async (req, res) => {
   try {
     const db = getDb(req);
-    const { password } = req.body;
-
-    if (!password) {
-      return res.status(400).json({ error: 'נדרשת סיסמה' });
-    }
-
+    const { password, confirmEmail } = req.body || {};
     const user = db.prepare('SELECT * FROM users WHERE id = ?').get(req.userId);
-    const validPassword = await bcrypt.compare(password, user.password);
-    
-    if (!validPassword) {
-      return res.status(401).json({ error: 'סיסמה שגויה' });
+
+    if (user.password) {
+      if (!password) {
+        return res.status(400).json({ error: 'נדרשת סיסמה' });
+      }
+      const validPassword = await bcrypt.compare(password, user.password);
+      if (!validPassword) {
+        return res.status(401).json({ error: 'סיסמה שגויה' });
+      }
+    } else {
+      // Passkey-only account (no password stored): the user confirms by typing the account's email
+      if (!confirmEmail) {
+        return res.status(400).json({ error: 'לאישור המחיקה יש להקליד את כתובת האימייל של החשבון' });
+      }
+      if (String(confirmEmail).toLowerCase() !== String(user.email).toLowerCase()) {
+        return res.status(401).json({ error: 'כתובת האימייל אינה תואמת לחשבון' });
+      }
     }
 
-    db.prepare('DELETE FROM users WHERE id = ?').run(req.userId);
+    // Personal workspaces go with the account; what the user created in shared workspaces stays there
+    deleteUserAccount(db, req.userId);
     res.json({ message: 'החשבון נמחק בהצלחה' });
   } catch (error) {
     console.error('Delete account error:', error);
@@ -262,63 +289,49 @@ router.delete('/account', authMiddleware, async (req, res) => {
   }
 });
 
-// Reset password (for forced password reset)
-router.post('/reset-password', async (req, res) => {
+// Forced password reset: the login (password or passkey) of a flagged user returned a short-lived
+// resetToken instead of a session. Setting the new password with it clears the flag and signs in.
+router.post('/reset-password', resetLimiter, async (req, res) => {
   try {
     const db = getDb(req);
-    const { userId, oldPassword, newPassword } = req.body;
+    const { resetToken, newPassword } = req.body || {};
 
-    if (!userId || !oldPassword || !newPassword) {
+    if (!resetToken || !newPassword) {
       return res.status(400).json({ error: 'כל השדות נדרשים' });
     }
 
-    if (newPassword.length < 4) {
+    if (typeof newPassword !== 'string' || newPassword.length < 4) {
       return res.status(400).json({ error: 'סיסמה חייבת להכיל לפחות 4 תווים' });
     }
 
+    const userId = verifyPasswordResetToken(resetToken);
+    if (!userId) {
+      return res.status(401).json({ error: 'תוקף האיפוס פג. התחבר שוב כדי להגדיר סיסמה חדשה' });
+    }
+
     const user = db.prepare('SELECT * FROM users WHERE id = ?').get(userId);
     if (!user) {
       return res.status(404).json({ error: 'משתמש לא נמצא' });
     }
-
-    // Verify old password
-    const validPassword = await bcrypt.compare(oldPassword, user.password);
-    if (!validPassword) {
-      return res.status(401).json({ error: 'סיסמה נוכחית שגויה' });
+    if (user.is_active === 0) {
+      return res.status(403).json({ error: 'החשבון הושהה. נא פנה למנהל המערכת' });
     }
 
-    // Check if password reset is required
+    // Also makes the token single-use: once the flag is cleared it can't set another password
     if (user.force_password_reset !== 1) {
       return res.status(400).json({ error: 'איפוס סיסמה לא נדרש' });
     }
 
-    // Update password and clear force reset flag
-    const hashedPassword = await bcrypt.hash(newPassword, 10);
-    db.prepare('UPDATE users SET password = ?, force_password_reset = 0 WHERE id = ?').run(hashedPassword, userId);
-
-    const token = generateToken(user.id);
+    if (user.password && await bcrypt.compare(newPassword, user.password)) {
+      return res.status(400).json({ error: 'הסיסמה החדשה חייבת להיות שונה מהסיסמה הנוכחית' });
+    }
 
-    // Get workspaces
-    const workspaces = db.prepare(`
-      SELECT w.*, wm.role
-      FROM workspaces w
-      JOIN workspace_members wm ON w.id = wm.workspace_id
-      WHERE wm.user_id = ?
-    `).all(user.id);
+    const hashedPassword = await bcrypt.hash(newPassword, 10);
+    db.prepare('UPDATE users SET password = ?, force_password_reset = 0, updated_at = CURRENT_TIMESTAMP WHERE id = ?')
+      .run(hashedPassword, userId);
 
-    res.json({
-      message: 'סיסמה שונתה בהצלחה',
-      user: {
-        id: user.id,
-        email: user.email,
-        name: user.name,
-        default_hourly_rate: user.default_hourly_rate,
-        is_admin: user.is_admin || 0
-      },
-      token,
-      workspaces,
-      currentWorkspace: workspaces[0] || null
-    });
+    const updated = db.prepare('SELECT * FROM users WHERE id = ?').get(userId);
+    res.json({ message: 'סיסמה שונתה בהצלחה', ...buildAuthResponse(db, updated) });
   } catch (error) {
     console.error('Reset password error:', error);
     res.status(500).json({ error: 'שגיאה באיפוס סיסמה' });
diff --git a/server/routes/catalog.js b/server/routes/catalog.js
index 16f97d1..cf5a48d 100644
--- a/server/routes/catalog.js
+++ b/server/routes/catalog.js
@@ -7,6 +7,9 @@ const router = express.Router();
 // Helper to get db
 const getDb = (req) => req.app.locals.db;
 
+// A price of 0 (a free item) is a real price; only a missing/empty one means "no price"
+const priceOrNull = (price) => (price === undefined || price === null || price === '' ? null : price);
+
 // קבלת כל הפריטים בקטלוג
 router.get('/', authMiddleware, workspaceMiddleware, (req, res) => {
   try {
@@ -73,7 +76,7 @@ router.post('/', authMiddleware, workspaceMiddleware, (req, res) => {
     db.prepare(`
       INSERT INTO catalog_items (id, workspace_id, user_id, name, description, price, pricing_type, unit, category, notes)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-    `).run(id, req.workspaceId, req.userId, name, description || null, price || null, pricing_type || 'fixed', unit || null, category || null, notes || null);
+    `).run(id, req.workspaceId, req.userId, name, description || null, priceOrNull(price), pricing_type || 'fixed', unit || null, category || null, notes || null);
     
     const item = db.prepare('SELECT * FROM catalog_items WHERE id = ?').get(id);
     res.status(201).json(item);
@@ -109,7 +112,7 @@ router.put('/:id', authMiddleware, workspaceMiddleware, (req, res) => {
     `).run(
       name, 
       description || null, 
-      price || null, 
+      priceOrNull(price), 
       pricing_type || 'fixed', 
       unit || null, 
       category || null, 
diff --git a/server/routes/client_sources.js b/server/routes/client_sources.js
index 388d433..0354bee 100644
--- a/server/routes/client_sources.js
+++ b/server/routes/client_sources.js
@@ -7,6 +7,9 @@ const router = Router();
 // Helper to get db
 const getDb = (req) => req.app.locals.db;
 
+// Global sources (workspace_id NULL) show up in every workspace, so only a system admin manages them
+const isSystemAdmin = (req) => getDb(req).prepare('SELECT is_admin FROM users WHERE id = ?').get(req.userId)?.is_admin === 1;
+
 // Apply auth middleware to all routes
 router.use(authMiddleware);
 router.use(workspaceMiddleware);
@@ -84,6 +87,10 @@ router.get('/stats', async (req, res) => {
 router.post('/:id/assign-to-workspace', async (req, res) => {
     try {
         const db = getDb(req);
+        if (!isSystemAdmin(req)) {
+            return res.status(403).json({ error: 'רק מנהל מערכת יכול לשייך מקור גלובלי' });
+        }
+
         const source = db.prepare('SELECT * FROM client_sources WHERE id = ?').get(req.params.id);
         
         if (!source) {
@@ -116,6 +123,10 @@ router.post('/', async (req, res) => {
             return res.status(400).json({ error: 'שם מקור נדרש' });
         }
         
+        if (is_global && !isSystemAdmin(req)) {
+            return res.status(403).json({ error: 'רק מנהל מערכת יכול ליצור מקור גלובלי' });
+        }
+
         // Determine workspace_id: NULL for global sources, current workspace otherwise
         const workspaceId = is_global ? null : req.workspaceId;
         
diff --git a/server/routes/credentials.js b/server/routes/credentials.js
index 75271c9..e90c493 100644
--- a/server/routes/credentials.js
+++ b/server/routes/credentials.js
@@ -189,16 +189,17 @@ router.put('/:id', authMiddleware, workspaceMiddleware, (req, res) => {
 
         const encrypted = encryptCredential({ username, password, notes }, req.workspaceId);
 
+        // Omitted secrets keep their stored (encrypted) value; an explicit null / '' clears them
         db.prepare(`
-      UPDATE credentials 
+      UPDATE credentials
       SET service_name = ?, username = ?, password = ?, url = ?, notes = ?, updated_at = CURRENT_TIMESTAMP
       WHERE id = ? AND workspace_id = ?
     `).run(
             service_name || existing.service_name,
-            encrypted.username,
-            encrypted.password,
+            username !== undefined ? encrypted.username : existing.username,
+            password !== undefined ? encrypted.password : existing.password,
             url !== undefined ? url : existing.url,
-            encrypted.notes,
+            notes !== undefined ? encrypted.notes : existing.notes,
             req.params.id,
             req.workspaceId
         );
diff --git a/server/routes/expenses.js b/server/routes/expenses.js
index 8008c55..f989a80 100644
--- a/server/routes/expenses.js
+++ b/server/routes/expenses.js
@@ -247,6 +247,11 @@ router.put('/:id', authMiddleware, workspaceMiddleware, (req, res) => {
       return res.status(404).json({ error: 'Expense not found' });
     }
 
+    // Same rule as POST, but only when the amount is being changed
+    if (amount !== undefined && (!amount || amount <= 0)) {
+      return res.status(400).json({ error: 'Valid amount is required' });
+    }
+
     // Only values that change are checked, so a stale stored reference does not block edits
     const foreignError = findForeignReference(db, req.workspaceId, {
       project_id: project_id !== existing.project_id ? project_id : null,
diff --git a/server/routes/leads.js b/server/routes/leads.js
index 4926a7c..87037c1 100644
--- a/server/routes/leads.js
+++ b/server/routes/leads.js
@@ -2,6 +2,7 @@ import { Router } from 'express';
 import crypto from 'crypto';
 import { v4 as uuidv4 } from 'uuid';
 import { authMiddleware, workspaceMiddleware } from '../middleware/auth.js';
+import { recurrenceDayFor } from '../utils/recurrence.js';
 import { decrypt } from '../utils/crypto.js';
 
 const router = Router();
@@ -996,10 +997,11 @@ router.post('/:id/reminders', async (req, res) => {
 
     const id = uuidv4();
     db.prepare(`
-      INSERT INTO reminders (id, user_id, workspace_id, content, notes, due_date, association_type, association_id, is_recurring, recurrence_interval)
-      VALUES (?, ?, ?, ?, ?, ?, 'lead', ?, ?, ?)
+      INSERT INTO reminders (id, user_id, workspace_id, content, notes, due_date, association_type, association_id, is_recurring, recurrence_interval, recurrence_day)
+      VALUES (?, ?, ?, ?, ?, ?, 'lead', ?, ?, ?, ?)
     `).run(id, req.userId, req.workspaceId, content, notes || null, due_date, req.params.id,
-      is_recurring ? 1 : 0, recurrence_interval || null);
+      is_recurring ? 1 : 0, recurrence_interval || null,
+      recurrenceDayFor({ is_recurring, recurrence_interval, due_date }));
 
     const reminder = db.prepare(`SELECT r.*, r.is_read as is_completed FROM reminders r WHERE r.id = ?`).get(id);
     res.status(201).json(reminder);
diff --git a/server/routes/passkeys.js b/server/routes/passkeys.js
index 1a4658b..189fe88 100644
--- a/server/routes/passkeys.js
+++ b/server/routes/passkeys.js
@@ -6,8 +6,9 @@ import {
   generateAuthenticationOptions,
   verifyAuthenticationResponse
 } from '@simplewebauthn/server';
-import { generateToken, authMiddleware } from '../middleware/auth.js';
-import { saveLocalSession } from '../utils/localSession.js';
+import { authMiddleware } from '../middleware/auth.js';
+import { createRateLimiter, ipAnd } from '../middleware/rateLimit.js';
+import { buildAuthResponse, buildPasswordResetRequiredResponse } from '../utils/authSession.js';
 
 const router = Router();
 
@@ -95,35 +96,10 @@ const insertPasskey = (db, { userId, registrationInfo, name }) => {
   return db.prepare('SELECT * FROM passkeys WHERE id = ?').get(id);
 };
 
-const getUserWorkspaces = (db, userId) => db.prepare(`
-  SELECT w.*, wm.role,
-    (SELECT COUNT(*) FROM workspace_members WHERE workspace_id = w.id) as member_count
-  FROM workspaces w
-  JOIN workspace_members wm ON w.id = wm.workspace_id
-  WHERE wm.user_id = ?
-  ORDER BY wm.joined_at ASC
-`).all(userId);
-
-const buildAuthResponse = (db, user) => {
-  const token = generateToken(user.id);
-  const workspaces = getUserWorkspaces(db, user.id);
-  const currentWorkspace = workspaces[0] || null;
-  if (currentWorkspace) {
-    saveLocalSession(token, currentWorkspace.id);
-  }
-  return {
-    user: {
-      id: user.id,
-      email: user.email,
-      name: user.name,
-      default_hourly_rate: user.default_hourly_rate,
-      is_admin: user.is_admin
-    },
-    token,
-    workspaces,
-    currentWorkspace
-  };
-};
+// Passkey sign-in: challenges per IP (every attempt counts - each one stores a flow), and failed
+// verifications per IP + credential
+const loginOptionsLimiter = createRateLimiter({ max: 30, key: (req) => req.ip });
+const loginVerifyLimiter = createRateLimiter({ max: 10, failuresOnly: true, key: ipAnd((req) => req.body?.response?.id) });
 
 // ===== Passwordless signup (public) =====
 
@@ -216,7 +192,7 @@ router.post('/signup/verify', async (req, res) => {
 
 // ===== Passwordless login (public, usernameless via discoverable credential) =====
 
-router.post('/login/options', async (req, res) => {
+router.post('/login/options', loginOptionsLimiter, async (req, res) => {
   try {
     const options = await generateAuthenticationOptions({
       rpID: RP_ID,
@@ -230,7 +206,7 @@ router.post('/login/options', async (req, res) => {
   }
 });
 
-router.post('/login/verify', async (req, res) => {
+router.post('/login/verify', loginVerifyLimiter, async (req, res) => {
   try {
     const db = getDb(req);
     const { flowId, response } = req.body;
@@ -275,6 +251,12 @@ router.post('/login/verify', async (req, res) => {
     db.prepare('UPDATE passkeys SET counter = ?, last_used_at = CURRENT_TIMESTAMP WHERE id = ?')
       .run(verification.authenticationInfo.newCounter, passkey.id);
 
+    // Flagged by the admin: a passkey doesn't skip the forced reset - no session until the new
+    // password is set (POST /api/auth/reset-password with this resetToken)
+    if (user.force_password_reset === 1) {
+      return res.json(buildPasswordResetRequiredResponse(user));
+    }
+
     res.json(buildAuthResponse(db, user));
   } catch (error) {
     console.error('Passkey login verify error:', error);
diff --git a/server/routes/payments.js b/server/routes/payments.js
index 4758be0..8169795 100644
--- a/server/routes/payments.js
+++ b/server/routes/payments.js
@@ -487,11 +487,11 @@ router.put('/:id/status', authMiddleware, workspaceMiddleware, (req, res) => {
             return res.status(404).json({ error: 'תשלום לא נמצא' });
         }
 
-        // Set paid_date when marking as paid
+        // Set paid_date when marking as paid, clear it for any other status (like PUT /:id)
         const paidDate = status === 'paid' ? new Date().toISOString() : null;
 
         db.prepare(`
-            UPDATE payments SET status = ?, paid_date = COALESCE(?, paid_date) WHERE id = ?
+            UPDATE payments SET status = ?, paid_date = ? WHERE id = ?
         `).run(status, paidDate, id);
 
         // Update project paid amount
diff --git a/server/routes/planned-slots.js b/server/routes/planned-slots.js
index 6d1beba..994d3d3 100644
--- a/server/routes/planned-slots.js
+++ b/server/routes/planned-slots.js
@@ -14,6 +14,18 @@ function formatDate(d) {
   return `${y}-${m}-${day}`;
 }
 
+// Helper: add whole months, clamping to the last day of the target month while keeping the
+// original day when the month has it (Jan 31 -> Feb 28/29 -> Mar 31; Date#setMonth would overflow)
+function addMonthsClamped(date, months) {
+  const day = date.getDate();
+  const d = new Date(date);
+  d.setDate(1);
+  d.setMonth(d.getMonth() + months);
+  const lastDay = new Date(d.getFullYear(), d.getMonth() + 1, 0).getDate();
+  d.setDate(Math.min(day, lastDay));
+  return d;
+}
+
 // Helper: generate recurrence dates until endDate
 function generateRecurrenceDates(startDate, recurrenceType, interval, endDate) {
   const dates = [];
@@ -22,7 +34,7 @@ function generateRecurrenceDates(startDate, recurrenceType, interval, endDate) {
   const MAX_OCCURRENCES = 365; // safety limit
 
   for (let i = 0; i < MAX_OCCURRENCES; i++) {
-    const d = new Date(start);
+    let d = new Date(start);
 
     switch (recurrenceType) {
       case 'daily':
@@ -35,10 +47,11 @@ function generateRecurrenceDates(startDate, recurrenceType, interval, endDate) {
         d.setDate(start.getDate() + (i * 14 * interval));
         break;
       case 'monthly':
-        d.setMonth(start.getMonth() + (i * interval));
+        // Always counted from the start, so the original day comes back after a short month
+        d = addMonthsClamped(start, i * interval);
         break;
       case 'yearly':
-        d.setFullYear(start.getFullYear() + (i * interval));
+        d = addMonthsClamped(start, i * interval * 12);
         break;
       default:
         d.setDate(start.getDate() + (i * 7));
@@ -108,6 +121,10 @@ router.post('/', authMiddleware, workspaceMiddleware, (req, res) => {
       if (!recurrence_end_date) {
         return res.status(400).json({ error: 'נדרש תאריך סיום לאירוע חוזר' });
       }
+      // Both are YYYY-MM-DD, so string order is date order; the same day is a one-slot series
+      if (String(recurrence_end_date).slice(0, 10) < String(date).slice(0, 10)) {
+        return res.status(400).json({ error: 'תאריך הסיום של אירוע חוזר לא יכול להיות לפני תאריך ההתחלה' });
+      }
 
       // Generate multiple slots with shared group ID
       const groupId = uuidv4();
diff --git a/server/routes/recurring.js b/server/routes/recurring.js
index 6ffccee..b9e29a2 100644
--- a/server/routes/recurring.js
+++ b/server/routes/recurring.js
@@ -7,6 +7,24 @@ const router = express.Router();
 // Helper to get db from app
 const getDb = (req) => req.app.locals.db;
 
+// Local calendar day as YYYY-MM-DD - toISOString() is UTC, so local midnight east of UTC
+// (e.g. Israel) would come out as the previous day
+const toLocalDateString = (d) =>
+  `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;
+
+// Next local calendar day a monthly template falls due, today included. day_of_month 29-31 is
+// clamped to the last day of a short month (31 -> Feb 28/29, Apr 30) instead of overflowing.
+const nextDueDate = (dayOfMonth, now) => {
+  const today = new Date(now.getFullYear(), now.getMonth(), now.getDate());
+  const dueIn = (monthOffset) => {
+    const lastDay = new Date(today.getFullYear(), today.getMonth() + monthOffset + 1, 0).getDate();
+    return new Date(today.getFullYear(), today.getMonth() + monthOffset, Math.min(dayOfMonth, lastDay));
+  };
+  const due = dueIn(0) >= today ? dueIn(0) : dueIn(1);
+  // Whole calendar days between local midnights (rounded: a DST day is 23 or 25 hours long)
+  return { due, daysUntilDue: Math.round((due - today) / 86400000) };
+};
+
 // Referenced client / project must belong to the workspace (otherwise their names leak through the joins)
 const findForeignReference = (db, workspaceId, { client_id, project_id }) => {
   if (client_id && !db.prepare('SELECT id FROM clients WHERE id = ? AND workspace_id = ?').get(client_id, workspaceId)) {
@@ -300,7 +318,6 @@ router.get('/upcoming/reminders', authMiddleware, workspaceMiddleware, (req, res
     const { days = 7 } = req.query;
 
     const today = new Date();
-    const currentDay = today.getDate();
     const daysAhead = parseInt(days);
 
     // Get active recurring payments that are due within the specified days
@@ -319,25 +336,14 @@ router.get('/upcoming/reminders', authMiddleware, workspaceMiddleware, (req, res
     `).all(req.workspaceId);
 
     // Filter to those due within the next X days
-    const upcoming = recurringPayments.filter(rp => {
-      const dayOfMonth = rp.day_of_month;
-      const daysUntilDue = dayOfMonth >= currentDay 
-        ? dayOfMonth - currentDay 
-        : (new Date(today.getFullYear(), today.getMonth() + 1, 0).getDate() - currentDay) + dayOfMonth;
-      
-      return daysUntilDue <= daysAhead;
-    }).map(rp => {
-      const dayOfMonth = rp.day_of_month;
-      const daysUntilDue = dayOfMonth >= currentDay 
-        ? dayOfMonth - currentDay 
-        : (new Date(today.getFullYear(), today.getMonth() + 1, 0).getDate() - currentDay) + dayOfMonth;
-      
+    const upcoming = recurringPayments.map(rp => {
+      const { due, daysUntilDue } = nextDueDate(rp.day_of_month, today);
       return {
         ...rp,
         days_until_due: daysUntilDue,
-        due_date: new Date(today.getFullYear(), today.getMonth() + (dayOfMonth >= currentDay ? 0 : 1), dayOfMonth).toISOString()
+        due_date: toLocalDateString(due)
       };
-    });
+    }).filter(rp => rp.days_until_due <= daysAhead);
 
     res.json(upcoming);
   } catch (error) {
diff --git a/server/routes/reminders.js b/server/routes/reminders.js
index 26026af..04da8dd 100644
--- a/server/routes/reminders.js
+++ b/server/routes/reminders.js
@@ -1,6 +1,7 @@
 import express from 'express';
 import { v4 as uuidv4 } from 'uuid';
 import { authMiddleware, workspaceMiddleware } from '../middleware/auth.js';
+import { ANCHORED_INTERVALS, recurrenceDayFor } from '../utils/recurrence.js';
 
 const router = express.Router();
 
@@ -10,6 +11,19 @@ const getDb = (req) => req.app.locals.db;
 router.use(authMiddleware);
 router.use(workspaceMiddleware);
 
+// Add whole months, landing on `anchorDay` or on the last day of a shorter month (Jan 31 + 1 month =
+// Feb 28/29, not Mar 3 as Date#setMonth would give). Local time, like the rest of the rescheduling.
+const addMonthsClamped = (date, months, anchorDay = date.getDate()) => {
+  const next = new Date(date);
+  next.setDate(1);
+  next.setMonth(next.getMonth() + months);
+  const lastDay = new Date(next.getFullYear(), next.getMonth() + 1, 0).getDate();
+  next.setDate(Math.min(anchorDay, lastDay));
+  return next;
+};
+
+const sameMoment = (a, b) => !!a && !!b && new Date(a).getTime() === new Date(b).getTime();
+
 // The record a reminder points at (and every linked project) must belong to the workspace -
 // GET joins their names into the response
 const ASSOCIATION_TABLES = { client: 'clients', project: 'projects', task: 'tasks', lead: 'leads' };
@@ -141,10 +155,11 @@ router.post('/', (req, res) => {
 
     db.prepare(`
       INSERT INTO reminders (
-        id, user_id, workspace_id, content, notes, due_date, association_type, association_id, is_recurring, recurrence_interval
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        id, user_id, workspace_id, content, notes, due_date, association_type, association_id, is_recurring, recurrence_interval, recurrence_day
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
     `).run(
-      id, req.userId, req.workspaceId, content, notes || null, due_date || null, association_type, cleanAssociationId, is_recurring ? 1 : 0, recurrence_interval || null
+      id, req.userId, req.workspaceId, content, notes || null, due_date || null, association_type, cleanAssociationId, is_recurring ? 1 : 0, recurrence_interval || null,
+      recurrenceDayFor({ is_recurring, recurrence_interval, due_date })
     );
 
     // Create project associations if project_ids provided
@@ -205,6 +220,10 @@ router.put('/:id', (req, res) => {
     // Handle recurring logic when marking as read (is_read = 1)
     if (updates.is_read === true && reminder.is_recurring && reminder.recurrence_interval) {
         let nextDate = new Date(reminder.due_date || new Date());
+        // Reminders from before the anchor existed (or created elsewhere) anchor on their current day
+        const anchorDay = ANCHORED_INTERVALS.includes(reminder.recurrence_interval)
+          ? (reminder.recurrence_day || nextDate.getDate())
+          : null;
 
         switch (reminder.recurrence_interval) {
             case 'daily':
@@ -214,18 +233,18 @@ router.put('/:id', (req, res) => {
                 nextDate.setDate(nextDate.getDate() + 7);
                 break;
             case 'monthly':
-                nextDate.setMonth(nextDate.getMonth() + 1);
+                nextDate = addMonthsClamped(nextDate, 1, anchorDay);
                 break;
             case 'yearly':
-                nextDate.setFullYear(nextDate.getFullYear() + 1);
+                nextDate = addMonthsClamped(nextDate, 12, anchorDay);
                 break;
         }
 
         db.prepare(`
             UPDATE reminders
-            SET due_date = ?, updated_at = CURRENT_TIMESTAMP
+            SET due_date = ?, recurrence_day = ?, updated_at = CURRENT_TIMESTAMP
             WHERE id = ?
-        `).run(nextDate.toISOString(), id);
+        `).run(nextDate.toISOString(), anchorDay, id);
 
         const updated = db.prepare('SELECT * FROM reminders WHERE id = ?').get(id);
         updated.project_associations = db.prepare(`
@@ -267,6 +286,22 @@ router.put('/:id', (req, res) => {
       }
     });
 
+    // The anchor day follows the schedule: a new due date (or turning monthly/yearly on) re-anchors,
+    // while re-sending the unchanged date with the rest of the form keeps it (28.2 of a 31st reminder)
+    if (['due_date', 'is_recurring', 'recurrence_interval'].some(key => updates[key] !== undefined)) {
+      const next = {
+        due_date: updates.due_date !== undefined ? updates.due_date : reminder.due_date,
+        is_recurring: updates.is_recurring !== undefined ? !!updates.is_recurring : !!reminder.is_recurring,
+        recurrence_interval: updates.recurrence_interval !== undefined ? updates.recurrence_interval : reminder.recurrence_interval
+      };
+      let recurrenceDay = recurrenceDayFor(next);
+      if (recurrenceDay !== null && reminder.recurrence_day && sameMoment(next.due_date, reminder.due_date)) {
+        recurrenceDay = reminder.recurrence_day;
+      }
+      sets.push('recurrence_day = ?');
+      values.push(recurrenceDay);
+    }
+
     if (sets.length > 0) {
       sets.push('updated_at = CURRENT_TIMESTAMP');
 
diff --git a/server/routes/stats.js b/server/routes/stats.js
index f7d331e..e3c127a 100644
--- a/server/routes/stats.js
+++ b/server/routes/stats.js
@@ -87,14 +87,17 @@ router.get('/dashboard', authMiddleware, workspaceMiddleware, (req, res) => {
     let isCustomRange = false;
 
     if (customStartDate && customEndDate) {
-      // Custom date range mode - use UTC boundaries
+      // The client sends the user's local start-of-day / end-of-day (a custom range, or the
+      // selected month together with month/year) as full ISO instants, used as-is - the server
+      // cannot know the user's timezone. A plain YYYY-MM-DD (older callers) still means the whole UTC day.
+      const isPlainDate = (value) => /^\d{4}-\d{2}-\d{2}$/.test(value);
       periodStart = new Date(customStartDate);
-      periodStart.setUTCHours(0, 0, 0, 0);
+      if (isPlainDate(req.query.startDate)) periodStart.setUTCHours(0, 0, 0, 0);
       periodEnd = new Date(customEndDate);
-      periodEnd.setUTCHours(23, 59, 59, 999);
-      isCustomRange = true;
+      if (isPlainDate(req.query.endDate)) periodEnd.setUTCHours(23, 59, 59, 999);
+      isCustomRange = requestedMonth === null || requestedYear === null;
     } else if (requestedMonth !== null && requestedYear !== null) {
-      // Specific month requested - build in UTC
+      // Specific month requested without instants (older callers) - build in UTC
       periodStart = new Date(Date.UTC(requestedYear, requestedMonth, 1));
       const lastDay = new Date(Date.UTC(requestedYear, requestedMonth + 1, 0)).getUTCDate();
       periodEnd = new Date(Date.UTC(requestedYear, requestedMonth, lastDay, 23, 59, 59, 999));
@@ -112,10 +115,9 @@ router.get('/dashboard', authMiddleware, workspaceMiddleware, (req, res) => {
     let activeSecondsPeriod = 0;
     let activeSecondsTotal = 0;
 
-    // Check if period includes today (UTC)
-    const todayStart = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate()));
-    const todayEnd = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate(), 23, 59, 59, 999));
-    const periodIncludesToday = periodStart <= todayEnd && periodEnd >= todayStart;
+    // Periods are whole days of the caller (local days, or UTC days for plain dates), so the
+    // period includes today exactly when it contains the current instant
+    const periodIncludesToday = periodStart <= now && now <= periodEnd;
 
     // Always calculate activeSecondsTotal for all-time stat
     const activeTimers = db.prepare('SELECT start_time, accumulated_seconds, is_running FROM active_timers WHERE user_id = ? AND workspace_id = ?').all(req.userId, req.workspaceId);
@@ -128,23 +130,22 @@ router.get('/dashboard', authMiddleware, workspaceMiddleware, (req, res) => {
       }
       activeSecondsTotal += timerDuration;
 
-      // Calculate proportional period attribution for active timers
-      if (periodIncludesToday) {
-        const timerStartMs = new Date(timer.start_time).getTime();
-        const timerEndMs = nowMs;
-        const clockSpan = timerEndMs - timerStartMs;
+      // Calculate proportional period attribution for active timers. The overlap decides, so a
+      // timer running since before midnight also counts its share for yesterday.
+      const timerStartMs = new Date(timer.start_time).getTime();
+      const timerEndMs = nowMs;
+      const clockSpan = timerEndMs - timerStartMs;
 
-        if (clockSpan <= 0) {
-          activeSecondsPeriod += timerDuration;
-          return;
-        }
+      if (clockSpan <= 0) {
+        if (periodIncludesToday) activeSecondsPeriod += timerDuration;
+        return;
+      }
 
-        const overlapStart = Math.max(timerStartMs, periodStart.getTime());
-        const overlapEnd = Math.min(timerEndMs, periodEnd.getTime());
+      const overlapStart = Math.max(timerStartMs, periodStart.getTime());
+      const overlapEnd = Math.min(timerEndMs, periodEnd.getTime());
 
-        if (overlapEnd > overlapStart) {
-          activeSecondsPeriod += Math.round(timerDuration * ((overlapEnd - overlapStart) / clockSpan));
-        }
+      if (overlapEnd > overlapStart) {
+        activeSecondsPeriod += Math.round(timerDuration * ((overlapEnd - overlapStart) / clockSpan));
       }
     });
 
diff --git a/server/routes/workspaces.js b/server/routes/workspaces.js
index 25cc729..8733746 100644
--- a/server/routes/workspaces.js
+++ b/server/routes/workspaces.js
@@ -1,12 +1,135 @@
 import { Router } from 'express';
+import fs from 'fs';
+import path from 'path';
 import { v4 as uuidv4 } from 'uuid';
 import { authMiddleware, workspaceMiddleware, canInviteMembers, canRemoveMember, canManageWorkspace } from '../middleware/auth.js';
+import { UPLOADS_DIR } from '../paths.js';
 
 const router = Router();
 
 // Helper to get db from app
 const getDb = (req) => req.app.locals.db;
 
+// ===== Deleting workspaces and accounts =====
+// Data belongs to the workspace: deleting a workspace deletes everything in it, and deleting an
+// account deletes the workspaces nobody else uses while the records the user created in shared
+// workspaces stay there, handed to the workspace owner (or another remaining member).
+
+// Runs fn as one transaction. fn must be synchronous: the database file is written on a later
+// tick (save() -> setImmediate), and writing it (export()) would end an open transaction.
+function inTransaction(db, fn) {
+  db.exec('BEGIN');
+  try {
+    const result = fn();
+    db.exec('COMMIT');
+    return result;
+  } catch (error) {
+    try { db.exec('ROLLBACK'); } catch { /* nothing to roll back */ }
+    throw error;
+  }
+}
+
+const tablesWithColumn = (db, column) => db.prepare(`
+  SELECT m.name FROM sqlite_master m
+  WHERE m.type = 'table' AND m.name NOT LIKE 'sqlite_%'
+    AND EXISTS (SELECT 1 FROM pragma_table_info(m.name) WHERE name = ?)
+`).all(column).map(row => row.name);
+
+// Deletes a workspace and every row that belongs to it. workspace_id on the data tables is a plain
+// column without a foreign key, so each table is cleared explicitly (children go with their parents
+// through the ON DELETE CASCADE keys). Returns the stored file names to remove from disk afterwards.
+function deleteWorkspaceRows(db, workspaceId) {
+  const storedFiles = db.prepare('SELECT storage_path FROM files WHERE workspace_id = ?').all(workspaceId)
+    .map(file => file.storage_path);
+  for (const table of tablesWithColumn(db, 'workspace_id')) {
+    db.prepare(`DELETE FROM ${table} WHERE workspace_id = ?`).run(workspaceId);
+  }
+  db.prepare('DELETE FROM workspaces WHERE id = ?').run(workspaceId);
+  return storedFiles;
+}
+
+// Removes uploaded files whose database rows are gone (only once the deletion is committed)
+function removeStoredFiles(db, storedFiles) {
+  for (const name of storedFiles) {
+    if (!name) continue;
+    try {
+      if (db.prepare('SELECT 1 FROM files WHERE storage_path = ?').get(name)) continue;
+      const filePath = path.join(UPLOADS_DIR, path.basename(name));
+      if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
+    } catch (error) {
+      console.error('Failed to remove uploaded file:', error.message);
+    }
+  }
+}
+
+export function deleteWorkspace(db, workspaceId) {
+  const storedFiles = inTransaction(db, () => deleteWorkspaceRows(db, workspaceId));
+  removeStoredFiles(db, storedFiles);
+}
+
+// The member who takes over a departing user's records in a workspace: the owner first, then
+// admins, then members, earliest joined first. `scope` is the SQL expression for the workspace id.
+const heirOf = (scope) => `
+  SELECT wm.user_id FROM workspace_members wm
+  WHERE wm.workspace_id = ${scope} AND wm.user_id != ?
+  ORDER BY CASE wm.role WHEN 'owner' THEN 0 WHEN 'admin' THEN 1 ELSE 2 END, wm.joined_at, wm.id
+  LIMIT 1
+`;
+
+// Per-user state that leaves with the account instead of being handed over
+const PERSONAL_TABLES = ['workspace_members', 'active_timers', 'planned_slots'];
+
+export function deleteUserAccount(db, userId) {
+  const storedFiles = inTransaction(db, () => {
+    const removedFiles = [];
+
+    // 1. Workspaces nobody else is a member of go away with all their data
+    const soleWorkspaces = db.prepare(`
+      SELECT w.id FROM workspaces w
+      WHERE (w.created_by = ? OR EXISTS (SELECT 1 FROM workspace_members wm WHERE wm.workspace_id = w.id AND wm.user_id = ?))
+        AND NOT EXISTS (SELECT 1 FROM workspace_members wm WHERE wm.workspace_id = w.id AND wm.user_id != ?)
+    `).all(userId, userId, userId);
+    for (const { id } of soleWorkspaces) {
+      removedFiles.push(...deleteWorkspaceRows(db, id));
+    }
+
+    // 2. A shared workspace the user owns gets a new owner (admins first, then members)
+    const owned = db.prepare(`SELECT workspace_id FROM workspace_members WHERE user_id = ? AND role = 'owner'`).all(userId);
+    for (const { workspace_id: workspaceId } of owned) {
+      const heir = db.prepare(heirOf('?')).get(workspaceId, userId);
+      if (heir) {
+        db.prepare(`UPDATE workspace_members SET role = 'owner' WHERE workspace_id = ? AND user_id = ?`).run(workspaceId, heir.user_id);
+      }
+    }
+    // workspaces.created_by is ON DELETE CASCADE - without this the shared workspace would be deleted
+    db.prepare(`
+      UPDATE workspaces SET created_by = (${heirOf('workspaces.id')})
+      WHERE created_by = ? AND EXISTS (SELECT 1 FROM workspace_members wm WHERE wm.workspace_id = workspaces.id AND wm.user_id != ?)
+    `).run(userId, userId, userId);
+
+    // 3. Everything they created in workspaces that stay is handed over (user_id is ON DELETE CASCADE)
+    const handOver = tablesWithColumn(db, 'user_id')
+      .filter(table => !PERSONAL_TABLES.includes(table) && db.columnExists(table, 'workspace_id'))
+      .map(table => [table, 'user_id']);
+    handOver.push(['shared_links', 'owner_id'], ['workspace_invites', 'created_by']);
+    for (const [table, column] of handOver) {
+      if (!db.columnExists(table, column) || !db.columnExists(table, 'workspace_id')) continue;
+      // Unique keys here are per workspace (e.g. integrations is UNIQUE(workspace_id, provider)), so
+      // changing user_id cannot collide; anything that still does fails the whole deletion (rolled back)
+      db.prepare(`
+        UPDATE ${table} SET ${column} = (${heirOf(`${table}.workspace_id`)})
+        WHERE ${column} = ? AND EXISTS (SELECT 1 FROM workspace_members wm WHERE wm.workspace_id = ${table}.workspace_id AND wm.user_id != ?)
+      `).run(userId, userId, userId);
+    }
+
+    // 4. The account itself; personal rows (memberships, running timers, planned slots, passkeys,
+    // read markers) go with it through ON DELETE CASCADE
+    db.prepare('DELETE FROM users WHERE id = ?').run(userId);
+    return removedFiles;
+  });
+  removeStoredFiles(db, storedFiles);
+}
+
 // Helper to generate a slug from name
 const generateSlug = (name) => {
   return name
@@ -150,8 +273,8 @@ router.delete('/:id', authMiddleware, workspaceMiddleware, (req, res) => {
       return res.status(400).json({ error: 'לא ניתן למחוק את ה-workspace היחיד שלך' });
     }
 
-    // Delete workspace (CASCADE will handle members, invites, and data)
-    db.prepare('DELETE FROM workspaces WHERE id = ?').run(req.workspaceId);
+    // Delete the workspace with all of its data (workspace_id has no foreign key, so no CASCADE)
+    deleteWorkspace(db, req.workspaceId);
 
     res.json({ message: 'Workspace נמחק בהצלחה' });
   } catch (error) {
diff --git a/server/tests/auth-hardening.test.js b/server/tests/auth-hardening.test.js
new file mode 100644
index 0000000..f1be8ee
--- /dev/null
+++ b/server/tests/auth-hardening.test.js
@@ -0,0 +1,204 @@
+// Forced password reset across both sign-in paths (password and passkey), the desktop session file,
+// and the sign-in rate limits.
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import request from 'supertest';
+import { v4 as uuidv4 } from 'uuid';
+
+const localSession = vi.hoisted(() => ({ saveLocalSession: vi.fn(), clearLocalSession: vi.fn() }));
+vi.mock('../utils/localSession.js', () => localSession);
+
+// The WebAuthn ceremony itself is the library's job; here every assertion is accepted
+const webauthn = vi.hoisted(() => ({
+  generateAuthenticationOptions: vi.fn(async () => ({ challenge: 'test-challenge' })),
+  verifyAuthenticationResponse: vi.fn(async () => ({ verified: true, authenticationInfo: { newCounter: 1 } })),
+  generateRegistrationOptions: vi.fn(),
+  verifyRegistrationResponse: vi.fn()
+}));
+vi.mock('@simplewebauthn/server', () => webauthn);
+
+import { getApp, createUser } from './helpers.js';
+import { adminClient } from './helpers-core.js';
+import { RATE_LIMIT_MESSAGE } from '../middleware/rateLimit.js';
+
+const post = async (url, body) => {
+  const { app } = await getApp();
+  return request(app).post(url).send(body);
+};
+const login = (email, password) => post('/api/auth/login', { email, password });
+
+const flag = async (userId) => {
+  const admin = await adminClient();
+  expect((await admin.post(`/api/admin/users/${userId}/force-password-reset`)).status).toBe(200);
+};
+
+// Gives the user a passkey and signs in with it (the mocked library accepts the assertion)
+const addPasskey = async (userId) => {
+  const { db } = await getApp();
+  const credentialId = `cred-${uuidv4()}`;
+  db.prepare(`
+    INSERT INTO passkeys (id, user_id, credential_id, public_key, counter, transports, device_type, backed_up, name)
+    VALUES (?, ?, ?, ?, 0, '[]', 'singleDevice', 0, 'Test key')
+  `).run(uuidv4(), userId, credentialId, Buffer.from('public-key').toString('base64url'));
+  return credentialId;
+};
+const passkeyLogin = async (credentialId) => {
+  const options = await post('/api/passkeys/login/options', {});
+  expect(options.status).toBe(200);
+  return post('/api/passkeys/login/verify', { flowId: options.body.flowId, response: { id: credentialId } });
+};
+
+beforeEach(() => {
+  localSession.saveLocalSession.mockClear();
+});
+
+describe('forced password reset - no session before the reset', () => {
+  it('password login: a reset token, nothing saved for the desktop app; the reset saves the new session', async () => {
+    const user = await createUser();
+    await flag(user.user.id);
+    localSession.saveLocalSession.mockClear();
+
+    const res = await login(user.user.email, user.password);
+    expect(res.body).toEqual({ requiresPasswordReset: true, resetToken: expect.any(String) });
+    expect(localSession.saveLocalSession).not.toHaveBeenCalled();
+
+    const reset = await post('/api/auth/reset-password', { resetToken: res.body.resetToken, newPassword: 'Fresh123!' });
+    expect(reset.status).toBe(200);
+    expect(localSession.saveLocalSession).toHaveBeenCalledWith(reset.body.token, user.workspaceId);
+  });
+
+  it('passkey login of a flagged user gets a reset token too, and the reset works without the old password', async () => {
+    const user = await createUser();
+    const credentialId = await addPasskey(user.user.id);
+    await flag(user.user.id);
+    localSession.saveLocalSession.mockClear();
+
+    const res = await passkeyLogin(credentialId);
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual({ requiresPasswordReset: true, resetToken: expect.any(String) });
+    expect(localSession.saveLocalSession).not.toHaveBeenCalled();
+
+    const reset = await post('/api/auth/reset-password', { resetToken: res.body.resetToken, newPassword: 'ViaPasskey1' });
+    expect(reset.status).toBe(200);
+    expect(reset.body.user).toMatchObject({ id: user.user.id, has_password: 1 });
+    expect((await login(user.user.email, 'ViaPasskey1')).body.requiresPasswordReset).toBe(false);
+
+    // Not flagged any more: the passkey signs in normally again
+    const again = await passkeyLogin(credentialId);
+    expect(again.body).toMatchObject({ requiresPasswordReset: false, token: expect.any(String) });
+  });
+
+  it('an unflagged passkey login is a normal session and is handed to the desktop app', async () => {
+    const user = await createUser();
+    const credentialId = await addPasskey(user.user.id);
+
+    const res = await passkeyLogin(credentialId);
+    expect(res.body).toMatchObject({ requiresPasswordReset: false, user: { id: user.user.id, has_password: 1 } });
+    expect(localSession.saveLocalSession).toHaveBeenCalledWith(res.body.token, user.workspaceId);
+  });
+});
+
+describe('password change - the current session stays signed in', () => {
+  it('hands the fresh token to the desktop app', async () => {
+    const user = await createUser();
+    localSession.saveLocalSession.mockClear();
+
+    const res = await user.put('/api/auth/profile').send({ password: 'NewPass1!', currentPassword: user.password });
+
+    expect(res.status).toBe(200);
+    expect(localSession.saveLocalSession).toHaveBeenCalledWith(res.body.token, user.workspaceId);
+  });
+
+  it('does not touch the desktop session for other profile updates', async () => {
+    const user = await createUser();
+    localSession.saveLocalSession.mockClear();
+
+    await user.put('/api/auth/profile').send({ name: 'Renamed' });
+
+    expect(localSession.saveLocalSession).not.toHaveBeenCalled();
+  });
+});
+
+describe('sign-in rate limits', () => {
+  afterEach(() => {
+    delete process.env.CLOCKWIZE_RATE_LIMIT;
+  });
+
+  it('are off in tests unless switched on', async () => {
+    const user = await createUser();
+    for (let i = 0; i < 12; i += 1) {
+      expect((await login(user.user.email, 'wrong')).status).toBe(401);
+    }
+    expect((await login(user.user.email, user.password)).status).toBe(200);
+  });
+
+  it('login: 10 failed attempts per IP + account, then 429 even with the right password', async () => {
+    process.env.CLOCKWIZE_RATE_LIMIT = 'on';
+    const user = await createUser();
+    const other = await createUser();
+
+    for (let i = 0; i < 10; i += 1) {
+      expect((await login(user.user.email, 'wrong')).status).toBe(401);
+    }
+    const blocked = await login(user.user.email.toUpperCase(), user.password);
+    expect(blocked.status).toBe(429);
+    expect(blocked.body.error).toBe(RATE_LIMIT_MESSAGE);
+    expect(Number(blocked.headers['retry-after'])).toBeGreaterThan(0);
+
+    // Another account from the same IP is not affected
+    expect((await login(other.user.email, other.password)).status).toBe(200);
+  });
+
+  it('login: a successful sign-in clears the failed attempts', async () => {
+    process.env.CLOCKWIZE_RATE_LIMIT = 'on';
+    const user = await createUser();
+
+    for (let i = 0; i < 9; i += 1) await login(user.user.email, 'wrong');
+    expect((await login(user.user.email, user.password)).status).toBe(200);
+    for (let i = 0; i < 9; i += 1) {
+      expect((await login(user.user.email, 'wrong')).status).toBe(401);
+    }
+    expect((await login(user.user.email, user.password)).status).toBe(200);
+  });
+
+  it('reset-password: 10 failed attempts per IP + account, then 429; other accounts still reset', async () => {
+    process.env.CLOCKWIZE_RATE_LIMIT = 'on';
+    const user = await createUser();
+    const other = await createUser();
+    await flag(user.user.id);
+    await flag(other.user.id);
+    const { resetToken } = (await login(user.user.email, user.password)).body;
+    const otherToken = (await login(other.user.email, other.password)).body.resetToken;
+
+    // Rejected attempts for this account (reusing the current password)
+    for (let i = 0; i < 10; i += 1) {
+      expect((await post('/api/auth/reset-password', { resetToken, newPassword: user.password })).status).toBe(400);
+    }
+    expect((await post('/api/auth/reset-password', { resetToken, newPassword: 'Fresh123!' })).status).toBe(429);
+
+    // Garbage tokens fill their own bucket ...
+    for (let i = 0; i < 11; i += 1) {
+      await post('/api/auth/reset-password', { resetToken: 'garbage', newPassword: 'abcd1234' });
+    }
+    expect((await post('/api/auth/reset-password', { resetToken: 'garbage', newPassword: 'abcd1234' })).status).toBe(429);
+    // ... and lock nobody else out
+    expect((await post('/api/auth/reset-password', { resetToken: otherToken, newPassword: 'Fresh123!' })).status).toBe(200);
+  });
+
+  it('passkey sign-in: failed verifications per IP + credential, and challenges per IP', async () => {
+    process.env.CLOCKWIZE_RATE_LIMIT = 'on';
+    for (let i = 0; i < 10; i += 1) {
+      expect((await post('/api/passkeys/login/verify', { flowId: 'expired', response: { id: 'unknown-cred' } })).status).toBe(400);
+    }
+    expect((await post('/api/passkeys/login/verify', { flowId: 'expired', response: { id: 'unknown-cred' } })).status).toBe(429);
+
+    // Challenges: 30 per IP (this file already used a few while the limiter was off - those don't count)
+    let status = 200;
+    let allowed = 0;
+    while (status === 200 && allowed < 40) {
+      status = (await post('/api/passkeys/login/options', {})).status;
+      if (status === 200) allowed += 1;
+    }
+    expect(allowed).toBe(30);
+    expect(status).toBe(429);
+  });
+});
diff --git a/server/tests/auth-profile-admin.test.js b/server/tests/auth-profile-admin.test.js
index 0c88fe1..023f8ab 100644
--- a/server/tests/auth-profile-admin.test.js
+++ b/server/tests/auth-profile-admin.test.js
@@ -20,7 +20,7 @@ describe('auth - profile', () => {
     const email = `renamed-${Date.now()}@example.com`;
     const res = await user.put('/api/auth/profile').send({ name: 'New Name', email, default_hourly_rate: 400 });
     expect(res.status).toBe(200);
-    expect(res.body).toEqual({ id: user.user.id, email, name: 'New Name', default_hourly_rate: 400 });
+    expect(res.body).toEqual({ id: user.user.id, email, name: 'New Name', default_hourly_rate: 400, has_password: 1 });
 
     const me = (await user.get('/api/auth/me')).body;
     expect(me).toMatchObject({ name: 'New Name', email, default_hourly_rate: 400 });
@@ -60,6 +60,51 @@ describe('auth - profile', () => {
     expect((await login(email, user.password)).status).toBe(401);
   });
 
+  it('a password change signs out the other sessions and returns a fresh token for this one', async () => {
+    const { app } = await getApp();
+    const user = await createUser();
+    const otherSession = (await login(user.user.email, user.password)).body.token;
+    const me = (token) => request(app).get('/api/auth/me').set('Authorization', `Bearer ${token}`);
+    expect((await me(otherSession)).status).toBe(200);
+
+    const res = await user.put('/api/auth/profile').send({ password: 'NewPass1!', currentPassword: user.password });
+    expect(res.status).toBe(200);
+    expect(res.body).toMatchObject({ id: user.user.id, has_password: 1, token: expect.any(String) });
+
+    expect((await user.get('/api/auth/me')).status).toBe(401);
+    expect((await me(otherSession)).status).toBe(401);
+    const fresh = await me(res.body.token);
+    expect(fresh.status).toBe(200);
+    expect(fresh.body.id).toBe(user.user.id);
+    // Signing in again works as usual
+    expect((await me((await login(user.user.email, 'NewPass1!')).body.token)).status).toBe(200);
+  });
+
+  it('a profile update without a new password keeps every session and returns no token', async () => {
+    const user = await createUser();
+    const res = await user.put('/api/auth/profile').send({ name: 'Renamed' });
+    expect(res.body.token).toBeUndefined();
+    expect((await user.get('/api/auth/me')).status).toBe(200);
+  });
+
+  it('a passkey-only account sets its first password without a current one', async () => {
+    const user = await createUser();
+    user.db.prepare("UPDATE users SET password = '' WHERE id = ?").run(user.user.id);
+    expect((await user.get('/api/auth/me')).body.has_password).toBe(0);
+
+    const res = await user.put('/api/auth/profile').send({ password: 'First123!' });
+    expect(res.status).toBe(200);
+    expect(res.body).toMatchObject({ has_password: 1, token: expect.any(String) });
+    expect((await login(user.user.email, 'First123!')).status).toBe(200);
+
+    // From now on the account has a password, so changing it needs the current one
+    const { app } = await getApp();
+    const again = await request(app).put('/api/auth/profile')
+      .set('Authorization', `Bearer ${res.body.token}`)
+      .send({ password: 'Second123!' });
+    expect(again.status).toBe(400);
+  });
+
   it('the stored password is a hash, never the plain text', async () => {
     const user = await createUser();
     const row = user.db.prepare('SELECT password FROM users WHERE id = ?').get(user.user.id);
@@ -108,53 +153,242 @@ describe('auth - account deletion', () => {
     expect(count('SELECT COUNT(*) AS n FROM active_timers WHERE user_id = ?', user.user.id)).toBe(0);
   });
 
-  // clients.user_id is ON DELETE CASCADE (database.js), so when a member deletes their account every
-  // client they created in a shared workspace - with all projects and everyone's entries - disappears
-  it.fails("a member deleting their account keeps the clients they created in someone else's workspace", async () => {
+  // clients.user_id is ON DELETE CASCADE (database.js), so deleting the user row alone would take every
+  // client they created in a shared workspace - with all projects and everyone's entries - with it
+  it("a member deleting their account keeps the clients they created in someone else's workspace", async () => {
     const owner = await createUser();
     const member = await addMember(owner, 'member');
     const client = (await member.post('/api/clients').send({ name: 'Team client' })).body;
+    const project = (await member.post('/api/projects').send({ client_id: client.id, name: 'Team project' })).body;
+    const task = (await member.post('/api/tasks').send({ project_id: project.id, name: 'Team task' })).body;
+    const memberEntry = await addEntry(member, { project_id: project.id, task_id: task.id, start: '2025-04-01T09:00:00.000Z', seconds: 1800 });
+    const ownerEntry = await addEntry(owner, { project_id: project.id, start: '2025-04-02T09:00:00.000Z', seconds: 600 });
+    await member.post('/api/timer/start').send({ project_id: project.id });
+    // ...and something in their own personal workspace
+    const personal = (await member.post('/api/clients', member.ownWorkspaceId).send({ name: 'Private client' })).body;
+
+    expect((await member.delete('/api/auth/account').send({ password: member.password })).status).toBe(200);
+
+    expect((await owner.get(`/api/clients/${client.id}`)).status).toBe(200);
+    expect((await owner.get(`/api/projects/${project.id}`)).status).toBe(200);
+    expect((await owner.get(`/api/tasks/${task.id}`)).status).toBe(200);
+    expect((await owner.get('/api/timer/entries')).body.map((e) => e.id).sort()).toEqual([memberEntry.id, ownerEntry.id].sort());
+
+    // The kept records now belong to the workspace owner; the account's personal state is gone
+    const { db } = owner;
+    const n = (sql, ...args) => db.prepare(sql).get(...args).n;
+    for (const table of ['clients', 'projects', 'tasks', 'time_entries', 'timer_intervals']) {
+      expect(n(`SELECT COUNT(*) AS n FROM ${table} WHERE user_id = ?`, member.user.id), table).toBe(0);
+    }
+    expect(db.prepare('SELECT user_id FROM clients WHERE id = ?').get(client.id).user_id).toBe(owner.user.id);
+    expect(n('SELECT COUNT(*) AS n FROM active_timers WHERE user_id = ?', member.user.id)).toBe(0);
+    expect(n('SELECT COUNT(*) AS n FROM workspace_members WHERE user_id = ?', member.user.id)).toBe(0);
+    expect(n('SELECT COUNT(*) AS n FROM workspaces WHERE id = ?', owner.workspaceId)).toBe(1);
+
+    // Their personal workspace went with the account, data included
+    expect(n('SELECT COUNT(*) AS n FROM workspaces WHERE id = ?', member.ownWorkspaceId)).toBe(0);
+    expect(n('SELECT COUNT(*) AS n FROM clients WHERE id = ?', personal.id)).toBe(0);
+    expect(n('SELECT COUNT(*) AS n FROM clients WHERE workspace_id = ?', member.ownWorkspaceId)).toBe(0);
+  });
+
+  // integrations is UNIQUE(workspace_id, provider), so the workspace's connection moves to the owner
+  // even when the owner has the same provider connected in another workspace
+  it("keeps the workspace's integration a member connected, even if the owner has that provider elsewhere", async () => {
+    const owner = await createUser();
+    const member = await addMember(owner, 'member');
+    const other = (await owner.post('/api/workspaces').send({ name: 'Owner other' })).body;
+    const insert = owner.db.prepare(`INSERT INTO integrations (id, user_id, workspace_id, provider) VALUES (?, ?, ?, 'morning')`);
+    const ownersId = `int-${Date.now()}-a`;
+    const teamId = `int-${Date.now()}-b`;
+    insert.run(ownersId, owner.user.id, other.id);
+    insert.run(teamId, member.user.id, owner.workspaceId);
+    const client = (await member.post('/api/clients').send({ name: 'Still kept' })).body;
+
     expect((await member.delete('/api/auth/account').send({ password: member.password })).status).toBe(200);
     expect((await owner.get(`/api/clients/${client.id}`)).status).toBe(200);
+    const rows = owner.db.prepare('SELECT id, user_id, workspace_id FROM integrations WHERE id IN (?, ?) ORDER BY id').all(ownersId, teamId);
+    expect(rows).toEqual([
+      { id: ownersId, user_id: owner.user.id, workspace_id: other.id },
+      { id: teamId, user_id: owner.user.id, workspace_id: owner.workspaceId }
+    ]);
+    expect((await owner.get('/api/integrations')).body.map((i) => i.provider)).toEqual(['morning']);
+  });
+
+  describe('passkey-only accounts (no password stored)', () => {
+    // A passkey signup stores password '' (routes/passkeys.js) - same state as this
+    const passkeyOnly = async () => {
+      const user = await createUser({ email: `Passkey.User-${Date.now()}@Example.com` });
+      user.db.prepare("UPDATE users SET password = '' WHERE id = ?").run(user.user.id);
+      return user;
+    };
+
+    it('/me tells the client whether the account has a password', async () => {
+      const withPassword = await createUser();
+      expect((await withPassword.get('/api/auth/me')).body.has_password).toBe(1);
+      expect((await (await passkeyOnly()).get('/api/auth/me')).body.has_password).toBe(0);
+    });
+
+    it('confirm the deletion with their email (exact, case-insensitive) instead of a password', async () => {
+      const user = await passkeyOnly();
+      const { client } = await createClientProjectTask(user);
+      const email = user.user.email;
+
+      const missing = await user.delete('/api/auth/account').send({});
+      expect(missing.status).toBe(400);
+      expect(missing.body.error).toBeTruthy();
+      expect((await user.delete('/api/auth/account').send({ password: 'anything' })).status).toBe(400);
+      expect((await user.delete('/api/auth/account').send({ confirmEmail: 'someone-else@example.com' })).status).toBe(401);
+      expect((await user.delete('/api/auth/account').send({ confirmEmail: `${email}x` })).status).toBe(401);
+      expect((await user.delete('/api/auth/account').send({ confirmEmail: ` ${email}` })).status).toBe(401);
+      expect((await user.get('/api/auth/me')).status).toBe(200);
+
+      const res = await user.delete('/api/auth/account').send({ confirmEmail: email.toUpperCase() });
+      expect(res.status).toBe(200);
+      expect((await user.get('/api/auth/me')).status).toBe(401);
+      expect(user.db.prepare('SELECT COUNT(*) AS n FROM clients WHERE id = ?').get(client.id).n).toBe(0);
+      expect(user.db.prepare('SELECT COUNT(*) AS n FROM workspaces WHERE id = ?').get(user.workspaceId).n).toBe(0);
+    });
+
+    it('a password account still needs its password - the email is not enough', async () => {
+      const user = await createUser();
+      const res = await user.delete('/api/auth/account').send({ confirmEmail: user.user.email });
+      expect(res.status).toBe(400);
+      expect((await user.get('/api/auth/me')).status).toBe(200);
+      expect((await user.delete('/api/auth/account').send({ confirmEmail: user.user.email, password: 'wrong' })).status).toBe(401);
+      expect((await user.get('/api/auth/me')).status).toBe(200);
+    });
+  });
+
+  it('an owner deleting their account hands a shared workspace to a remaining member, admins first', async () => {
+    const owner = await createUser({ name: 'Leaving owner' });
+    const { client, project } = await createClientProjectTask(owner);
+    const member = await addMember(owner, 'member', { name: 'Early member' });
+    const admin = await addMember(owner, 'admin', { name: 'Later admin' });
+    const memberClient = (await member.post('/api/clients').send({ name: 'Member client' })).body;
+    const invite = (await owner.post(`/api/workspaces/${owner.workspaceId}/invites`).send({})).body;
+    await owner.put('/api/addons/catalog').send({ isEnabled: true });
+    const ws = owner.workspaceId;
+
+    expect((await owner.delete('/api/auth/account').send({ password: owner.password })).status).toBe(200);
+
+    // The workspace survives (workspaces.created_by is ON DELETE CASCADE) with the admin as its owner
+    const { db } = admin;
+    expect(db.prepare('SELECT created_by FROM workspaces WHERE id = ?').get(ws)).toEqual({ created_by: admin.user.id });
+    expect((await admin.get('/api/workspaces/current')).body.role).toBe('owner');
+    expect((await member.get('/api/workspaces/current')).body.role).toBe('member');
+    expect((await admin.get(`/api/workspaces/${ws}/members`)).body.map((m) => m.name).sort()).toEqual(['Early member', 'Later admin']);
+
+    // All of the workspace's data is still there; the departed owner's records now belong to the new owner
+    expect((await admin.get('/api/clients')).body.map((c) => c.id).sort()).toEqual([client.id, memberClient.id].sort());
+    expect((await member.get(`/api/projects/${project.id}`)).status).toBe(200);
+    expect(db.prepare('SELECT user_id FROM clients WHERE id = ?').get(client.id).user_id).toBe(admin.user.id);
+    expect(db.prepare('SELECT user_id FROM clients WHERE id = ?').get(memberClient.id).user_id).toBe(member.user.id);
+    expect(db.prepare('SELECT created_by FROM workspace_invites WHERE id = ?').get(invite.id)).toEqual({ created_by: admin.user.id });
+    expect((await admin.get('/api/addons/enabled')).body).toContain('catalog');
+    expect((await member.get(`/api/workspaces/invite/${invite.token}`)).body.inviter_name).toBe('Later admin');
   });
 });
 
 describe('auth - forced password reset', () => {
-  it('validates the request', async () => {
+  const flag = async (user) => {
+    const admin = await adminClient();
+    expect((await admin.post(`/api/admin/users/${user.user.id}/force-password-reset`)).status).toBe(200);
+  };
+  const resetPassword = async (body) => {
     const { app } = await getApp();
+    return request(app).post('/api/auth/reset-password').send(body);
+  };
+
+  it('validates the request', async () => {
     const user = await createUser();
-    const post = (body) => request(app).post('/api/auth/reset-password').send(body);
-    expect((await post({ userId: user.user.id, oldPassword: user.password })).status).toBe(400);
-    expect((await post({ userId: user.user.id, oldPassword: user.password, newPassword: 'abc' })).status).toBe(400);
-    expect((await post({ userId: 'nope', oldPassword: 'x', newPassword: 'abcd1234' })).status).toBe(404);
-    expect((await post({ userId: user.user.id, oldPassword: 'wrong', newPassword: 'abcd1234' })).status).toBe(401);
-    // Not flagged for a reset
-    expect((await post({ userId: user.user.id, oldPassword: user.password, newPassword: 'abcd1234' })).status).toBe(400);
-    expect((await login(user.user.email, user.password)).status).toBe(200);
+    await flag(user);
+    const { resetToken } = (await login(user.user.email, user.password)).body;
+
+    expect((await resetPassword({ resetToken })).status).toBe(400);
+    expect((await resetPassword({ newPassword: 'abcd1234' })).status).toBe(400);
+    expect((await resetPassword({ resetToken, newPassword: 'abc' })).status).toBe(400);
+    expect((await resetPassword({ resetToken: 'not-a-token', newPassword: 'abcd1234' })).status).toBe(401);
+    // A normal session token is not a reset token
+    const other = await createUser();
+    expect((await resetPassword({ resetToken: other.token, newPassword: 'abcd1234' })).status).toBe(401);
+    // The old password again doesn't count as a new one
+    expect((await resetPassword({ resetToken, newPassword: user.password })).status).toBe(400);
+    // Nothing changed: the user still has to reset
+    expect((await login(user.user.email, user.password)).body.requiresPasswordReset).toBe(true);
   });
 
-  it('admin forces a reset, login flags it, and the reset clears it', async () => {
+  it('admin forces a reset, login gets a reset token instead of a session, and the reset signs in', async () => {
     const { app } = await getApp();
-    const admin = await adminClient();
     const user = await createUser();
-    expect((await admin.post(`/api/admin/users/${user.user.id}/force-password-reset`)).status).toBe(200);
+    await createUser(); // another user's workspace must not leak into the response
+    await flag(user);
 
     const flagged = await login(user.user.email, user.password);
     expect(flagged.status).toBe(200);
-    expect(flagged.body.requiresPasswordReset).toBe(true);
+    expect(flagged.body).toEqual({ requiresPasswordReset: true, resetToken: expect.any(String) });
 
-    const reset = await request(app)
-      .post('/api/auth/reset-password')
-      .send({ userId: user.user.id, oldPassword: user.password, newPassword: 'Fresh123!' });
+    // The reset token is not a session
+    const asSession = await request(app).get('/api/auth/me').set('Authorization', `Bearer ${flagged.body.resetToken}`);
+    expect(asSession.status).toBe(401);
+
+    const reset = await resetPassword({ resetToken: flagged.body.resetToken, newPassword: 'Fresh123!' });
     expect(reset.status).toBe(200);
-    expect(reset.body.token).toBeTruthy();
-    expect(reset.body.currentWorkspace.id).toBe(user.workspaceId);
+    expect(reset.body).toMatchObject({
+      requiresPasswordReset: false,
+      user: { id: user.user.id, email: user.user.email, has_password: 1, is_admin: 0 },
+      currentWorkspace: { id: user.workspaceId, role: 'owner', member_count: 1 }
+    });
+    expect(reset.body.workspaces.map((w) => w.id)).toEqual([user.workspaceId]);
+    const me = await request(app).get('/api/auth/me').set('Authorization', `Bearer ${reset.body.token}`);
+    expect(me.status).toBe(200);
+    expect(me.body.id).toBe(user.user.id);
+
+    // Single use: the flag is gone, so the same reset token can't set another password
+    expect((await resetPassword({ resetToken: flagged.body.resetToken, newPassword: 'Again123!' })).status).toBe(400);
 
     const after = await login(user.user.email, 'Fresh123!');
     expect(after.status).toBe(200);
     expect(after.body.requiresPasswordReset).toBe(false);
+    expect(after.body.token).toBeTruthy();
     expect((await login(user.user.email, user.password)).status).toBe(401);
   });
+
+  it('flagging a user ends their existing sessions for good', async () => {
+    const user = await createUser();
+    expect((await user.get('/api/auth/me')).status).toBe(200);
+
+    await flag(user);
+    const blocked = await user.get('/api/clients');
+    expect(blocked.status).toBe(401);
+    expect(blocked.body.error).toBe('אנא התחבר למערכת');
+    expect((await user.get('/api/auth/me')).status).toBe(401);
+
+    const { resetToken } = (await login(user.user.email, user.password)).body;
+    const reset = await resetPassword({ resetToken, newPassword: 'Fresh123!' });
+    // Sessions from before the flag stay revoked after the reset; the new one works
+    expect((await user.get('/api/auth/me')).status).toBe(401);
+    const { app } = await getApp();
+    expect((await request(app).get('/api/auth/me').set('Authorization', `Bearer ${reset.body.token}`)).status).toBe(200);
+  });
+
+  it('the admin cannot impersonate a flagged user', async () => {
+    const admin = await adminClient();
+    const user = await createUser();
+    await flag(user);
+    const res = await admin.post(`/api/admin/impersonate/${user.user.id}`);
+    expect(res.status).toBe(409);
+    expect(res.body.token).toBeUndefined();
+  });
+
+  it('a suspended user cannot use a reset token', async () => {
+    const admin = await adminClient();
+    const user = await createUser();
+    await flag(user);
+    const { resetToken } = (await login(user.user.email, user.password)).body;
+    await admin.post(`/api/admin/users/${user.user.id}/toggle-active`);
+
+    expect((await resetPassword({ resetToken, newPassword: 'Fresh123!' })).status).toBe(403);
+  });
 });
 
 describe('admin - access control', () => {
@@ -246,6 +480,17 @@ describe('admin - actions', () => {
     expect((await login(user.user.email, user.password)).status).toBe(401);
   });
 
+  it('a password set by the admin signs the user out of existing sessions', async () => {
+    const admin = await adminClient();
+    const user = await createUser();
+    expect((await user.get('/api/auth/me')).status).toBe(200);
+    // iatMs is in milliseconds; make sure the revocation time is strictly later than the token
+    await new Promise((resolve) => setTimeout(resolve, 5));
+    expect((await admin.post(`/api/admin/users/${user.user.id}/set-password`).send({ password: 'byAdmin2' })).status).toBe(200);
+    expect((await user.get('/api/auth/me')).status).toBe(401);
+    expect((await login(user.user.email, 'byAdmin2')).status).toBe(200);
+  });
+
   it('suspends and re-activates an account', async () => {
     const admin = await adminClient();
     const user = await createUser();
@@ -276,4 +521,15 @@ describe('admin - actions', () => {
     expect(user.db.prepare('SELECT COUNT(*) AS n FROM workspaces WHERE id = ?').get(user.workspaceId).n).toBe(0);
     expect((await admin.get('/api/admin/users')).body.find((u) => u.id === user.user.id)).toBeUndefined();
   });
+
+  it("deleting a user keeps what they created in someone else's workspace", async () => {
+    const admin = await adminClient();
+    const owner = await createUser();
+    const member = await addMember(owner, 'member');
+    const client = (await member.post('/api/clients').send({ name: 'Kept client' })).body;
+    expect((await admin.delete(`/api/admin/users/${member.user.id}`)).status).toBe(200);
+    expect((await owner.get(`/api/clients/${client.id}`)).status).toBe(200);
+    expect(owner.db.prepare('SELECT user_id FROM clients WHERE id = ?').get(client.id).user_id).toBe(owner.user.id);
+    expect(owner.db.prepare('SELECT COUNT(*) AS n FROM workspaces WHERE id = ?').get(member.ownWorkspaceId).n).toBe(0);
+  });
 });
diff --git a/server/tests/catalog-sources-addons.test.js b/server/tests/catalog-sources-addons.test.js
index 1a36a58..ebf7a74 100644
--- a/server/tests/catalog-sources-addons.test.js
+++ b/server/tests/catalog-sources-addons.test.js
@@ -1,8 +1,10 @@
-import { describe, it, expect, beforeAll } from 'vitest';
+import { describe, it, expect, beforeAll, vi } from 'vitest';
 import request from 'supertest';
 import { v4 as uuidv4 } from 'uuid';
+import initSqlJs from 'sql.js';
 import { getApp, createUser, createClientProjectTask } from './helpers.js';
 import { addMember, ENCRYPTED_SHAPE, legacyEncrypt } from './helpers-money.js';
+import { adminClient } from './helpers-core.js';
 
 let app;
 let cryptoUtil;
@@ -61,11 +63,19 @@ describe('catalog', () => {
     expect((await user.get(`/api/catalog/${it_.id}`)).body.name).toBe('Site v2');
   });
 
-  // Bug: `price || null` turns a free (price 0) item into "no price"
-  it.fails('keeps a price of 0', async () => {
+  // `price || null` used to turn a free (price 0) item into "no price"
+  it('keeps a price of 0', async () => {
     const user = await createUser();
     const res = await item(user, { name: 'Free consult', price: 0 });
     expect(res.body.price).toBe(0);
+
+    const paid = (await item(user, { name: 'Paid', price: 100 })).body;
+    const updated = await user.put(`/api/catalog/${paid.id}`).send({ name: 'Paid', price: 0 });
+    expect(updated.body.price).toBe(0);
+
+    // An empty or missing price is still "no price"
+    expect((await item(user, { name: 'Empty', price: '' })).body.price).toBeNull();
+    expect((await user.put(`/api/catalog/${paid.id}`).send({ name: 'Paid' })).body.price).toBeNull();
   });
 
   it('deletes and then 404s', async () => {
@@ -114,9 +124,10 @@ describe('client sources', () => {
   it('lists the workspace\'s own sources plus global ones, never another workspace\'s', async () => {
     const alice = await createUser();
     const bob = await createUser();
+    const admin = await adminClient();
     const own = (await source(alice, { name: uniq('Own') })).body;
     const bobs = (await source(bob, { name: uniq('Bobs') })).body;
-    const global = (await source(bob, { name: uniq('Global'), is_global: true })).body;
+    const global = (await source(admin, { name: uniq('Global'), is_global: true })).body;
     expect(global.workspace_id).toBeNull();
 
     const ids = (await alice.get('/api/client-sources')).body.map(s => s.id);
@@ -129,7 +140,7 @@ describe('client sources', () => {
     const alice = await createUser();
     const bob = await createUser();
     const ref = (await source(alice, { name: uniq('Referral') })).body;
-    const global = (await source(alice, { name: uniq('Shared Global'), is_global: true })).body;
+    const global = (await source(await adminClient(), { name: uniq('Shared Global'), is_global: true })).body;
     const c1 = (await alice.post('/api/clients').send({ name: 'C1', source_id: ref.id, sub_source: 'Moshe' })).body;
     await alice.post('/api/clients').send({ name: 'C2', source_id: ref.id });
     await alice.post('/api/clients').send({ name: 'C3', source_id: global.id });
@@ -148,21 +159,53 @@ describe('client sources', () => {
     expect(JSON.stringify(res.body)).not.toContain('Bob client');
   });
 
-  it('assigns a global source to the current workspace once', async () => {
-    const alice = await createUser();
+  it('a system admin assigns a global source to their current workspace once', async () => {
+    const admin = await adminClient();
     const bob = await createUser();
-    const global = (await source(alice, { name: uniq('Claimable'), is_global: true })).body;
+    const global = (await source(admin, { name: uniq('Claimable'), is_global: true })).body;
     const bobs = (await source(bob, { name: uniq('Bob private') })).body;
 
-    expect((await alice.post(`/api/client-sources/${uuidv4()}/assign-to-workspace`)).status).toBe(404);
-    const res = await alice.post(`/api/client-sources/${global.id}/assign-to-workspace`);
+    expect((await admin.post(`/api/client-sources/${uuidv4()}/assign-to-workspace`)).status).toBe(404);
+    const res = await admin.post(`/api/client-sources/${global.id}/assign-to-workspace`);
     expect(res.status).toBe(200);
-    expect(res.body.workspace_id).toBe(alice.workspaceId);
-    expect((await alice.post(`/api/client-sources/${global.id}/assign-to-workspace`)).status).toBe(400);
+    expect(res.body.workspace_id).toBe(admin.workspaceId);
+    expect((await admin.post(`/api/client-sources/${global.id}/assign-to-workspace`)).status).toBe(400);
 
     // Another workspace's own source cannot be taken over
-    expect((await alice.post(`/api/client-sources/${bobs.id}/assign-to-workspace`)).status).toBe(400);
-    expect(alice.db.prepare('SELECT workspace_id FROM client_sources WHERE id = ?').get(bobs.id).workspace_id).toBe(bob.workspaceId);
+    expect((await admin.post(`/api/client-sources/${bobs.id}/assign-to-workspace`)).status).toBe(400);
+    expect(admin.db.prepare('SELECT workspace_id FROM client_sources WHERE id = ?').get(bobs.id).workspace_id).toBe(bob.workspaceId);
+  });
+
+  // A global source shows up in every workspace, so a regular user must not be able to create one
+  // (planting a name in everyone's list) or claim one for their own workspace (taking it from everyone)
+  it('only a system admin creates global sources; a workspace owner or admin role is not enough', async () => {
+    const owner = await createUser();
+    const wsAdmin = await createUser();
+    addMember(owner, wsAdmin, 'admin');
+    const name = uniq('Everywhere');
+
+    for (const [user, ws] of [[owner, owner.workspaceId], [wsAdmin, owner.workspaceId]]) {
+      const res = await user.post('/api/client-sources', ws).send({ name, is_global: true });
+      expect(res.status).toBe(403);
+      expect(res.body.error).toBeTruthy();
+    }
+    expect(owner.db.prepare('SELECT COUNT(*) AS n FROM client_sources WHERE name = ?').get(name).n).toBe(0);
+
+    // Without the flag the source is created in the user's own workspace
+    const own = await source(owner, { name });
+    expect(own.status).toBe(201);
+    expect(own.body.workspace_id).toBe(owner.workspaceId);
+  });
+
+  it('a regular user cannot claim a global source for their workspace', async () => {
+    const admin = await adminClient();
+    const user = await createUser();
+    const global = (await source(admin, { name: uniq('Not yours'), is_global: true })).body;
+
+    const res = await user.post(`/api/client-sources/${global.id}/assign-to-workspace`);
+    expect(res.status).toBe(403);
+    expect(user.db.prepare('SELECT workspace_id FROM client_sources WHERE id = ?').get(global.id).workspace_id).toBeNull();
+    expect((await user.get('/api/client-sources')).body.map(s => s.id)).toContain(global.id);
   });
 });
 
@@ -218,14 +261,126 @@ describe('addons', () => {
     expect((await bob.get('/api/addons/enabled')).body).not.toContain('catalog');
   });
 
-  // Bug (database.js, not fixed here): user_addons has UNIQUE(user_id, addon_id), so a member of
-  // two workspaces gets a 500 the first time they toggle an addon in their second workspace
-  it.fails('a member of two workspaces can toggle the same addon in both', async () => {
+  // user_addons used to be UNIQUE(user_id, addon_id), so a member of two workspaces got a 500 the
+  // first time they toggled an addon in their second workspace
+  it('a member of two workspaces can toggle the same addon in both', async () => {
     const owner = await createUser();
     const member = await createUser();
     addMember(owner, member, 'admin');
     expect((await member.put('/api/addons/catalog').send({ isEnabled: true })).status).toBe(200);
     expect((await member.put('/api/addons/catalog', owner.workspaceId).send({ isEnabled: true })).status).toBe(200);
+    expect((await member.put('/api/addons', owner.workspaceId).send({ addons: [{ id: 'notes', isEnabled: false }] })).status).toBe(200);
+    expect((await member.put('/api/addons').send({ addons: [{ id: 'notes', isEnabled: false }] })).status).toBe(200);
+
+    // Each workspace keeps its own state
+    await member.put('/api/addons/catalog', owner.workspaceId).send({ isEnabled: false });
+    expect((await member.get('/api/addons/enabled')).body).toContain('catalog');
+    expect((await owner.get('/api/addons/enabled')).body).not.toContain('catalog');
+    const rows = member.db.prepare("SELECT workspace_id FROM user_addons WHERE addon_id = 'catalog' AND workspace_id IN (?, ?)").all(owner.workspaceId, member.workspaceId);
+    expect(rows).toHaveLength(2);
+  });
+
+  // Turning an addon on or off changes the workspace for everyone, so it is an owner/admin decision
+  it('a plain member cannot toggle addons; the owner and a workspace admin can', async () => {
+    const owner = await createUser();
+    const admin = await createUser();
+    const member = await createUser();
+    addMember(owner, admin, 'admin');
+    addMember(owner, member, 'member');
+    const ws = owner.workspaceId;
+
+    expect((await member.put('/api/addons/files', ws).send({ isEnabled: false })).status).toBe(403);
+    expect((await member.put('/api/addons', ws).send({ addons: [{ id: 'files', isEnabled: false }] })).status).toBe(403);
+    expect(owner.db.prepare('SELECT COUNT(*) AS n FROM user_addons WHERE workspace_id = ?').get(ws).n).toBe(0);
+    expect((await member.get('/api/addons/enabled', ws)).body).toContain('files');
+
+    expect((await admin.put('/api/addons/catalog', ws).send({ isEnabled: true })).status).toBe(200);
+    expect((await owner.put('/api/addons/files').send({ isEnabled: false })).status).toBe(200);
+    const enabled = (await member.get('/api/addons/enabled', ws)).body;
+    expect(enabled).toContain('catalog');
+    expect(enabled).not.toContain('files');
+
+    // A member still manages their own personal workspace
+    expect((await member.put('/api/addons/catalog').send({ isEnabled: true })).status).toBe(200);
+  });
+
+  describe('user_addons unique key migration', () => {
+    const OLD_SCHEMA = `CREATE TABLE user_addons (
+      id TEXT PRIMARY KEY,
+      user_id TEXT NOT NULL,
+      addon_id TEXT NOT NULL,
+      is_enabled INTEGER DEFAULT 1,
+      created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+      updated_at DATETIME DEFAULT CURRENT_TIMESTAMP, workspace_id TEXT,
+      FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
+      UNIQUE(user_id, addon_id)
+    )`;
+
+    // A throwaway database with the pre-migration user_addons table
+    async function oldDatabase() {
+      const { Database } = await import('../database.js');
+      const SQL = await initSqlJs();
+      const db = new Database(new SQL.Database());
+      db.pragma('foreign_keys = ON');
+      db.exec('CREATE TABLE users (id TEXT PRIMARY KEY)');
+      db.exec(OLD_SCHEMA);
+      for (const id of ['u1', 'u2']) db.prepare('INSERT INTO users (id) VALUES (?)').run(id);
+      return db;
+    }
+    const uniqueKeys = (db) => db.prepare(`SELECT name FROM pragma_index_list('user_addons') WHERE "unique" = 1 AND origin = 'u'`).all()
+      .map(i => db.prepare('SELECT name FROM pragma_index_info(?) ORDER BY seqno').all(i.name).map(c => c.name));
+    const allRows = (db) => db.prepare('SELECT id, user_id, workspace_id, addon_id, is_enabled, created_at, updated_at FROM user_addons ORDER BY id').all();
+
+    it('rebuilds the table keyed by workspace, keeps every row, and runs only once', async () => {
+      const { migrateUserAddonsUniqueKey } = await import('../database.js');
+      const db = await oldDatabase();
+      const insert = db.prepare(`INSERT INTO user_addons (id, user_id, workspace_id, addon_id, is_enabled, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)`);
+      insert.run('a', 'u1', 'w1', 'catalog', 1, '2025-01-01 10:00:00', '2025-01-02 10:00:00');
+      insert.run('b', 'u1', 'w1', 'files', 0, '2025-01-01 10:00:00', '2025-01-01 10:00:00');
+      insert.run('c', 'u2', 'w2', 'catalog', 0, '2025-02-01 10:00:00', '2025-02-01 10:00:00');
+      insert.run('d', 'u2', null, 'notes', 1, '2025-02-01 10:00:00', '2025-02-01 10:00:00');
+      const before = allRows(db);
+
+      expect(migrateUserAddonsUniqueKey(db)).toBe(true);
+      expect(uniqueKeys(db)).toEqual([['workspace_id', 'addon_id']]);
+      expect(allRows(db)).toEqual(before);
+      expect(db.prepare("SELECT COUNT(*) AS n FROM sqlite_master WHERE name = 'user_addons_new'").get().n).toBe(0);
+
+      // Idempotent: a second start changes nothing
+      expect(migrateUserAddonsUniqueKey(db)).toBe(false);
+      expect(allRows(db)).toEqual(before);
+
+      // The bug is gone: the same user can now have the addon in a second workspace...
+      insert.run('e', 'u1', 'w2b', 'catalog', 1, '2025-03-01 10:00:00', '2025-03-01 10:00:00');
+      // ...and the foreign key to users still holds
+      const errors = vi.spyOn(console, 'error').mockImplementation(() => {});
+      try {
+        expect(() => insert.run('f', 'ghost', 'w3', 'catalog', 1, null, null)).toThrow();
+      } finally {
+        errors.mockRestore();
+      }
+      db.prepare('DELETE FROM users WHERE id = ?').run('u2');
+      expect(allRows(db).map(r => r.id)).toEqual(['a', 'b', 'e']);
+    });
+
+    it('leaves the old table untouched when the rows do not fit the new key', async () => {
+      const { migrateUserAddonsUniqueKey } = await import('../database.js');
+      const db = await oldDatabase();
+      // Two users toggled the same addon in one workspace - allowed by the old key, not by the new one
+      db.prepare(`INSERT INTO user_addons (id, user_id, workspace_id, addon_id) VALUES ('a', 'u1', 'w1', 'catalog')`).run();
+      db.prepare(`INSERT INTO user_addons (id, user_id, workspace_id, addon_id) VALUES ('b', 'u2', 'w1', 'catalog')`).run();
+      const before = allRows(db);
+
+      const errors = vi.spyOn(console, 'error').mockImplementation(() => {});
+      try {
+        expect(migrateUserAddonsUniqueKey(db)).toBe(false);
+      } finally {
+        errors.mockRestore();
+      }
+      expect(uniqueKeys(db)).toEqual([['user_id', 'addon_id']]);
+      expect(allRows(db)).toEqual(before);
+      expect(db.prepare("SELECT COUNT(*) AS n FROM sqlite_master WHERE name = 'user_addons_new'").get().n).toBe(0);
+    });
   });
 
   describe('settings', () => {
@@ -310,6 +465,32 @@ describe('addons', () => {
       expect(cryptoUtil.decryptDetailed(row.setting_value, user.workspaceId)).toEqual({ value: 'sk-legacy-abcdefgh', legacy: false });
     });
 
+    it('only the owner or a workspace admin changes settings; a member only sees whether a key is configured', async () => {
+      const owner = await createUser();
+      const admin = await createUser();
+      const member = await createUser();
+      addMember(owner, admin, 'admin');
+      addMember(owner, member, 'member');
+      const ws = owner.workspaceId;
+      const { getAddonSetting } = await import('../routes/addons.js');
+      await owner.put('/api/addons/ai_assistant/settings').send({ openai_api_key: 'sk-owner-key-1234567890', model: 'gpt-4o' });
+
+      const denied = await member.put('/api/addons/ai_assistant/settings', ws).send({ openai_api_key: 'sk-member-override-0000' });
+      expect(denied.status).toBe(403);
+      expect(denied.body.error).toBeTruthy();
+      expect(await getAddonSetting(owner.db, ws, owner.user.id, 'ai_assistant', 'openai_api_key')).toBe('sk-owner-key-1234567890');
+
+      const seen = await member.get('/api/addons/ai_assistant/settings', ws);
+      expect(seen.status).toBe(200);
+      expect(seen.body).toEqual({ openai_api_key_configured: true, model: 'gpt-4o' });
+      expect(JSON.stringify(seen.body)).not.toContain('sk-o');
+
+      expect((await owner.get('/api/addons/ai_assistant/settings')).body.openai_api_key).toBe('sk-o****7890');
+      expect((await admin.get('/api/addons/ai_assistant/settings', ws)).body.openai_api_key).toBe('sk-o****7890');
+      expect((await admin.put('/api/addons/ai_assistant/settings', ws).send({ openai_api_key: 'sk-admin-rotated-12345' })).status).toBe(200);
+      expect(await getAddonSetting(owner.db, ws, owner.user.id, 'ai_assistant', 'openai_api_key')).toBe('sk-admin-rotated-12345');
+    });
+
     it('settings are isolated between workspaces, and a stolen ciphertext does not decrypt elsewhere', async () => {
       const alice = await createUser();
       const bob = await createUser();
@@ -328,6 +509,81 @@ describe('addons', () => {
   });
 });
 
+describe('integrations unique key migration', () => {
+  const OLD_SCHEMA = `CREATE TABLE integrations (
+      id TEXT PRIMARY KEY,
+      user_id TEXT NOT NULL,
+      provider TEXT NOT NULL,
+      api_key TEXT,
+      api_secret TEXT,
+      access_token TEXT,
+      refresh_token TEXT,
+      expires_at DATETIME,
+      settings TEXT,
+      is_active INTEGER DEFAULT 1,
+      created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+      updated_at DATETIME DEFAULT CURRENT_TIMESTAMP, workspace_id TEXT,
+      FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
+      UNIQUE(user_id, provider)
+    )`;
+  const COLUMNS = 'id, user_id, workspace_id, provider, api_key, api_secret, access_token, refresh_token, expires_at, settings, is_active, created_at, updated_at';
+
+  async function oldDatabase() {
+    const { Database } = await import('../database.js');
+    const SQL = await initSqlJs();
+    const db = new Database(new SQL.Database());
+    db.pragma('foreign_keys = ON');
+    db.exec('CREATE TABLE users (id TEXT PRIMARY KEY)');
+    db.exec(OLD_SCHEMA);
+    for (const id of ['u1', 'u2']) db.prepare('INSERT INTO users (id) VALUES (?)').run(id);
+    return db;
+  }
+  const uniqueKeys = (db) => db.prepare(`SELECT name FROM pragma_index_list('integrations') WHERE "unique" = 1 AND origin = 'u'`).all()
+    .map(i => db.prepare('SELECT name FROM pragma_index_info(?) ORDER BY seqno').all(i.name).map(c => c.name));
+  const allRows = (db) => db.prepare(`SELECT ${COLUMNS} FROM integrations ORDER BY id`).all();
+  const quiet = (fn) => {
+    const errors = vi.spyOn(console, 'error').mockImplementation(() => {});
+    try { return fn(); } finally { errors.mockRestore(); }
+  };
+
+  it('rebuilds the table keyed by workspace + provider, keeps every row and column, and runs only once', async () => {
+    const { migrateIntegrationsUniqueKey } = await import('../database.js');
+    const db = await oldDatabase();
+    const insert = db.prepare(`INSERT INTO integrations (${COLUMNS}) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`);
+    insert.run('a', 'u1', 'w1', 'morning', 'key', 'secret', 'tok', 'ref', '2026-01-01', '{"x":1}', 1, '2025-01-01 10:00:00', '2025-01-02 10:00:00');
+    insert.run('b', 'u2', 'w2', 'morning', null, null, null, null, null, null, 0, '2025-02-01 10:00:00', '2025-02-01 10:00:00');
+    const before = allRows(db);
+
+    expect(migrateIntegrationsUniqueKey(db)).toBe(true);
+    expect(uniqueKeys(db)).toEqual([['workspace_id', 'provider']]);
+    expect(allRows(db)).toEqual(before);
+    expect(migrateIntegrationsUniqueKey(db)).toBe(false);
+    expect(allRows(db)).toEqual(before);
+
+    // The same user can now connect the provider in a second workspace, but a workspace has one connection
+    insert.run('c', 'u1', 'w3', 'morning', null, null, null, null, null, null, 1, null, null);
+    expect(() => quiet(() => insert.run('d', 'u2', 'w3', 'morning', null, null, null, null, null, null, 1, null, null))).toThrow();
+    expect(() => quiet(() => insert.run('e', 'ghost', 'w4', 'morning', null, null, null, null, null, null, 1, null, null))).toThrow();
+  });
+
+  it('leaves the old table untouched when two connections share a workspace + provider', async () => {
+    const { migrateIntegrationsUniqueKey } = await import('../database.js');
+    const db = await oldDatabase();
+    db.prepare(`INSERT INTO integrations (id, user_id, workspace_id, provider) VALUES ('a', 'u1', 'w1', 'morning')`).run();
+    db.prepare(`INSERT INTO integrations (id, user_id, workspace_id, provider) VALUES ('b', 'u2', 'w1', 'morning')`).run();
+    const before = allRows(db);
+    expect(quiet(() => migrateIntegrationsUniqueKey(db))).toBe(false);
+    expect(uniqueKeys(db)).toEqual([['user_id', 'provider']]);
+    expect(allRows(db)).toEqual(before);
+    expect(db.prepare("SELECT COUNT(*) AS n FROM sqlite_master WHERE name = 'integrations_new'").get().n).toBe(0);
+  });
+
+  it('the app database already uses the new key', async () => {
+    const { db } = await getApp();
+    expect(uniqueKeys(db)).toEqual([['workspace_id', 'provider']]);
+  });
+});
+
 describe('ai and integrations (auth only - no network)', () => {
   it('require a login', async () => {
     const calls = [
diff --git a/server/tests/credentials-crypto.test.js b/server/tests/credentials-crypto.test.js
index ad3b5ea..cde0865 100644
--- a/server/tests/credentials-crypto.test.js
+++ b/server/tests/credentials-crypto.test.js
@@ -254,14 +254,25 @@ describe('credentials API', () => {
     expect(after.password).not.toContain('p2');
   });
 
-  // Bug: PUT keeps service_name/url when they are omitted, but silently wipes the encrypted
-  // username/password/notes to NULL (the UI always sends every field, so it is API-only).
-  it.fails('keeps stored secrets when a partial update omits them', async () => {
+  it('keeps stored secrets when a partial update omits them', async () => {
     const user = await createUser();
     const created = await user.post('/api/credentials').send({ service_name: 'S', username: 'keep-me', password: 'keep-pass', notes: 'keep-notes' });
+    const before = rawCredential(user.db, created.body.id);
     const res = await user.put(`/api/credentials/${created.body.id}`).send({ url: 'https://new.example.com' });
     expect(res.status).toBe(200);
-    expect(res.body).toMatchObject({ username: 'keep-me', password: 'keep-pass', notes: 'keep-notes' });
+    expect(res.body).toMatchObject({ username: 'keep-me', password: 'keep-pass', notes: 'keep-notes', url: 'https://new.example.com' });
+    // The stored ciphertext is kept as-is, not re-encrypted
+    expect(rawCredential(user.db, created.body.id).password).toBe(before.password);
+  });
+
+  it('an explicit null or empty string clears only that secret', async () => {
+    const user = await createUser();
+    const created = await user.post('/api/credentials').send({ service_name: 'S', username: 'u', password: 'p', notes: 'n' });
+    const noNotes = await user.put(`/api/credentials/${created.body.id}`).send({ notes: null });
+    expect(noNotes.body).toMatchObject({ username: 'u', password: 'p', notes: null });
+    const noUser = await user.put(`/api/credentials/${created.body.id}`).send({ username: '' });
+    expect(noUser.body).toMatchObject({ username: null, password: 'p', notes: null });
+    expect(rawCredential(user.db, created.body.id).username).toBeNull();
   });
 
   it('deletes and then 404s', async () => {
diff --git a/server/tests/expenses-recurring.test.js b/server/tests/expenses-recurring.test.js
index 6368d1b..7dbbed8 100644
--- a/server/tests/expenses-recurring.test.js
+++ b/server/tests/expenses-recurring.test.js
@@ -130,11 +130,13 @@ describe('expenses', () => {
     expect(cleared.body.category_id).toBeNull();
   });
 
-  // Bug: POST rejects amount <= 0, but PUT accepts any amount (negative expenses skew totals)
-  it.fails('rejects a non-positive amount on update too', async () => {
+  it('rejects a non-positive amount on update too', async () => {
     const user = await createUser();
     const e = (await expense(user, { amount: 100 })).body;
     expect((await user.put(`/api/expenses/${e.id}`).send({ amount: -100 })).status).toBe(400);
+    expect((await user.put(`/api/expenses/${e.id}`).send({ amount: 0 })).status).toBe(400);
+    expect((await user.put(`/api/expenses/${e.id}`).send({ amount: null })).status).toBe(400);
+    expect(user.db.prepare('SELECT amount FROM payments WHERE id = ?').get(e.id).amount).toBe(100);
   });
 
   it('an expense pointing at a category that no longer belongs to the workspace can still be edited', async () => {
@@ -336,6 +338,9 @@ describe('recurring payments', () => {
   describe('upcoming reminders', () => {
     afterEach(() => vi.useRealTimers());
 
+    // Local calendar day of a Date, the way due_date is reported
+    const ymd = (d) => `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;
+
     it('returns active templates due within N days, wrapping into next month', async () => {
       // Pin "today" to the 25th of the current month (local time) - only Date is faked
       const now = new Date();
@@ -364,7 +369,7 @@ describe('recurring payments', () => {
 
       expect(byId[due25.id].days_until_due).toBe(0);
       expect(byId[due28.id].days_until_due).toBe(3);
-      expect(new Date(byId[due28.id].due_date).getDate()).toBe(28);
+      expect(byId[due28.id].due_date).toBe(ymd(new Date(today.getFullYear(), today.getMonth(), 28)));
       expect(Boolean(byId[due2.id])).toBe(expected2 <= 7);
       expect(byId[inactive.id]).toBeUndefined();
       expect(res.body).toHaveLength(expected2 <= 7 ? 3 : 2);
@@ -372,12 +377,102 @@ describe('recurring payments', () => {
       const wide = await user.get('/api/recurring/upcoming/reminders?days=31');
       const wideById = Object.fromEntries(wide.body.map(r => [r.id, r]));
       expect(wideById[due2.id].days_until_due).toBe(expected2);
-      const nextMonth2 = new Date(wideById[due2.id].due_date);
-      expect(nextMonth2.getDate()).toBe(2);
-      expect(nextMonth2.getMonth()).toBe((today.getMonth() + 1) % 12);
+      expect(wideById[due2.id].due_date).toBe(ymd(new Date(today.getFullYear(), today.getMonth() + 1, 2)));
       expect(wideById[due20.id].days_until_due).toBe(daysInMonth - 25 + 20);
     });
 
+    it('reports due_date as the intended local calendar day east of UTC (Israel)', async () => {
+      // Local midnight in Israel is 21:00/22:00 UTC of the previous day, so toISOString() used to
+      // report the 14th for a payment due on the 15th
+      const originalTZ = process.env.TZ;
+      process.env.TZ = 'Asia/Jerusalem';
+      try {
+        vi.useFakeTimers({ toFake: ['Date'] });
+        vi.setSystemTime(new Date('2026-10-08T09:00:00.000Z')); // Oct 8, 12:00 in Israel
+        const user = await createUser();
+        const { client } = await createClientProjectTask(user);
+        const mk = async (day) => (await recurring(user, { client_id: client.id, amount: 10, day_of_month: day })).body;
+        const due8 = await mk(8);
+        const due15 = await mk(15);
+        const due2 = await mk(2);
+
+        const byId = Object.fromEntries((await user.get('/api/recurring/upcoming/reminders?days=31')).body.map(r => [r.id, r]));
+        expect(byId[due8.id].due_date).toBe('2026-10-08');
+        expect(byId[due15.id].due_date).toBe('2026-10-15');
+        expect(byId[due2.id].due_date).toBe('2026-11-02');
+        expect(byId[due15.id].days_until_due).toBe(7);
+
+        // Wrapping into January of the next year (a fresh login - the old token is not valid in December)
+        vi.setSystemTime(new Date('2026-12-25T09:00:00.000Z'));
+        const later = await createUser();
+        const laterClient = (await createClientProjectTask(later)).client;
+        const jan2 = (await recurring(later, { client_id: laterClient.id, amount: 10, day_of_month: 2 })).body;
+        const jan = (await later.get('/api/recurring/upcoming/reminders?days=31')).body.find(r => r.id === jan2.id);
+        expect(jan.due_date).toBe('2027-01-02');
+      } finally {
+        if (originalTZ === undefined) delete process.env.TZ;
+        else process.env.TZ = originalTZ;
+      }
+    });
+
+    it('clamps day 29-31 to the end of short months and counts local calendar days', async () => {
+      const originalTZ = process.env.TZ;
+      process.env.TZ = 'Asia/Jerusalem';
+      vi.useFakeTimers({ toFake: ['Date'] });
+      // Templates due on the 28th-31st, seen at a pinned "now" (a fresh login for every date)
+      const upcomingAt = async (iso, days) => {
+        vi.setSystemTime(new Date(iso));
+        const user = await createUser();
+        const { client } = await createClientProjectTask(user);
+        const ids = {};
+        for (const day of [28, 29, 30, 31]) {
+          ids[day] = (await recurring(user, { client_id: client.id, amount: 10, day_of_month: day })).body.id;
+        }
+        const list = (await user.get(`/api/recurring/upcoming/reminders?days=${days}`)).body;
+        return (day) => {
+          const r = list.find(x => x.id === ids[day]);
+          return r && [r.due_date, r.days_until_due];
+        };
+      };
+      try {
+        // Feb 25 2026 (28 days): 29/30/31 fall due on Feb 28 in 3 days, not on Mar 1-3
+        let at = await upcomingAt('2026-02-25T10:00:00.000Z', 7);
+        expect(at(28)).toEqual(['2026-02-28', 3]);
+        expect(at(29)).toEqual(['2026-02-28', 3]);
+        expect(at(30)).toEqual(['2026-02-28', 3]);
+        expect(at(31)).toEqual(['2026-02-28', 3]);
+
+        // On Feb 28 itself the "31st" is due today
+        at = await upcomingAt('2026-02-28T10:00:00.000Z', 0);
+        expect(at(31)).toEqual(['2026-02-28', 0]);
+        expect(at(28)).toEqual(['2026-02-28', 0]);
+
+        // Leap year: the 29th exists, the 30th/31st clamp to it
+        at = await upcomingAt('2028-02-27T10:00:00.000Z', 7);
+        expect(at(29)).toEqual(['2028-02-29', 2]);
+        expect(at(31)).toEqual(['2028-02-29', 2]);
+
+        // Jan 31: the 31st is today; the 29th/30th have passed and are next due on Feb 28
+        at = await upcomingAt('2026-01-31T10:00:00.000Z', 31);
+        expect(at(31)).toEqual(['2026-01-31', 0]);
+        expect(at(30)).toEqual(['2026-02-28', 28]);
+        expect(at(29)).toEqual(['2026-02-28', 28]);
+
+        // April has 30 days: the 31st is due on Apr 30
+        at = await upcomingAt('2026-04-29T09:00:00.000Z', 7);
+        expect(at(31)).toEqual(['2026-04-30', 1]);
+        expect(at(30)).toEqual(['2026-04-30', 1]);
+
+        // Across the DST switch (Fri Mar 27, a 23-hour day) days are still whole calendar days
+        at = await upcomingAt('2026-03-25T10:00:00.000Z', 7);
+        expect(at(29)).toEqual(['2026-03-29', 4]);
+        expect(at(31)).toEqual(['2026-03-31', 6]);
+      } finally {
+        if (originalTZ === undefined) delete process.env.TZ;
+        else process.env.TZ = originalTZ;
+      }
+    });
+
     it('defaults to 7 days and treats a non-numeric window as none', async () => {
       const user = await createUser();
       const { client } = await createClientProjectTask(user);
diff --git a/server/tests/leads.test.js b/server/tests/leads.test.js
index d31e99a..9dc4584 100644
--- a/server/tests/leads.test.js
+++ b/server/tests/leads.test.js
@@ -3,6 +3,7 @@ import request from 'supertest';
 import { v4 as uuidv4 } from 'uuid';
 import { getApp, createUser, createClientProjectTask } from './helpers.js';
 import { twoWorkspaces, addMember, insertTimeEntry } from './helpers-money.js';
+import { adminClient } from './helpers-core.js';
 
 let app;
 beforeAll(async () => { ({ app } = await getApp()); });
@@ -505,8 +506,30 @@ describe('leads: cross-workspace isolation', () => {
     const dump = JSON.stringify((await bob.get(`/api/leads/${lead.id}`)).body);
     expect(dump).not.toContain('Alice');
 
-    // A global source (no workspace) is fine
-    const global = (await bob.post('/api/client-sources').send({ name: `Global ${uuidv4()}`, is_global: true })).body;
-    expect((await bob.post('/api/leads').send({ name: 'ok', source_id: global.id })).status).toBe(201);
+    // A global source (no workspace, created by a system admin) is fine
+    const created = await (await adminClient()).post('/api/client-sources').send({ name: `Global ${uuidv4()}`, is_global: true });
+    expect(created.status).toBe(201);
+    const global = created.body;
+    expect(global.workspace_id).toBeNull();
+    const ok = await bob.post('/api/leads').send({ name: 'ok', source_id: global.id });
+    expect(ok.status).toBe(201);
+    expect(ok.body.source_id).toBe(global.id);
+    expect((await bob.get(`/api/leads/${ok.body.id}`)).body.source_id).toBe(global.id);
+  });
+});
+
+describe('lead reminders keep their day of the month', () => {
+  it('stores the recurrence day when a monthly lead reminder is created', async () => {
+    const user = await createUser();
+    const lead = await user.post('/api/leads').send({ name: 'Recurring lead' });
+    expect(lead.status).toBe(201);
+    const res = await user.post(`/api/leads/${lead.body.id}/reminders`).send({
+      content: 'follow up',
+      due_date: new Date(2027, 0, 31, 10, 0).toISOString(),
+      is_recurring: true,
+      recurrence_interval: 'monthly'
+    });
+    expect(res.status).toBe(201);
+    expect(res.body.recurrence_day).toBe(31);
   });
 });
diff --git a/server/tests/payments.test.js b/server/tests/payments.test.js
index b7a971d..9ca53d0 100644
--- a/server/tests/payments.test.js
+++ b/server/tests/payments.test.js
@@ -285,12 +285,12 @@ describe('payments: update, status and delete', () => {
     expect(paidAmount(user, project.id)).toBe(0);
   });
 
-  // Bug: PUT /:id/status uses COALESCE(?, paid_date), so un-paying a payment keeps its old
-  // paid_date, while the full PUT /:id clears it.
-  it.fails('quick status change away from paid clears paid_date', async () => {
+  it('quick status change away from paid clears paid_date', async () => {
     const user = await createUser();
     const p = (await pay(user, { amount: 90 })).body;
+    expect(p.paid_date).toBeTruthy();
     const res = await user.put(`/api/payments/${p.id}/status`).send({ status: 'pending' });
+    expect(res.body.status).toBe('pending');
     expect(res.body.paid_date).toBeNull();
   });
 
diff --git a/server/tests/reminders-alerts-slots.test.js b/server/tests/reminders-alerts-slots.test.js
index 91f87aa..9a1163f 100644
--- a/server/tests/reminders-alerts-slots.test.js
+++ b/server/tests/reminders-alerts-slots.test.js
@@ -100,12 +100,133 @@ describe('reminders', () => {
     }
   });
 
-  // Bug: monthly recurrence uses Date#setMonth, so the 31st rolls over into the month after next
-  it.fails('a monthly reminder on Jan 31 moves to the end of February, not into March', async () => {
+  it('a monthly reminder on Jan 31 moves to the end of February, not into March', async () => {
     const user = await createUser();
     const r = (await remind(user, { content: 'm', due_date: '2026-01-31T09:00:00.000Z', is_recurring: true, recurrence_interval: 'monthly' })).body;
     const res = await user.put(`/api/reminders/${r.id}`).send({ is_read: true });
     expect(res.body.due_date.slice(0, 7)).toBe('2026-02');
+    expect(res.body.due_date).toBe('2026-02-28T09:00:00.000Z');
+  });
+
+  it('a yearly reminder on Feb 29 moves to Feb 28 of the next year, not into March', async () => {
+    const user = await createUser();
+    const r = (await remind(user, { content: 'y', due_date: '2028-02-29T09:00:00.000Z', is_recurring: true, recurrence_interval: 'yearly' })).body;
+    const res = await user.put(`/api/reminders/${r.id}`).send({ is_read: true });
+    expect(res.body.due_date).toBe('2029-02-28T09:00:00.000Z');
+  });
+
+  describe('monthly / yearly reminders keep their day of the month', () => {
+    // Rescheduling works in the server's local time (as the UI does), so compare local calendar dates
+    const localDate = (iso) => {
+      const d = new Date(iso);
+      return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;
+    };
+    const localHour = (iso) => new Date(iso).getHours();
+    const complete = async (user, id) => {
+      const res = await user.put(`/api/reminders/${id}`).send({ is_read: true });
+      expect(res.status).toBe(200);
+      return res.body;
+    };
+    const monthly = (user, due_date, extra = {}) =>
+      remind(user, { content: 'rent', due_date, is_recurring: true, recurrence_interval: 'monthly', ...extra });
+
+    it('a reminder on the 31st goes 31.1 -> 28.2 -> 31.3 -> 30.4 -> 31.5', async () => {
+      const user = await createUser();
+      const r = (await monthly(user, '2026-01-31T09:00:00.000Z')).body;
+      expect(r.recurrence_day).toBe(new Date('2026-01-31T09:00:00.000Z').getDate());
+      const seen = [];
+      let current = r;
+      for (let i = 0; i < 4; i++) {
+        current = await complete(user, r.id);
+        seen.push(localDate(current.due_date));
+        expect(localHour(current.due_date)).toBe(localHour(r.due_date));
+      }
+      expect(seen).toEqual(['2026-02-28', '2026-03-31', '2026-04-30', '2026-05-31']);
+      expect(current.recurrence_day).toBe(31);
+    });
+
+    it('a yearly reminder on Feb 29 is on Feb 28 in common years and back on Feb 29 in the next leap year', async () => {
+      const user = await createUser();
+      const r = (await remind(user, { content: 'y', due_date: '2028-02-29T09:00:00.000Z', is_recurring: true, recurrence_interval: 'yearly' })).body;
+      const seen = [];
+      for (let i = 0; i < 4; i++) seen.push(localDate((await complete(user, r.id)).due_date));
+      expect(seen).toEqual(['2029-02-28', '2030-02-28', '2031-02-28', '2032-02-29']);
+    });
+
+    it('re-saving the form with the same date keeps the anchor; a new date or a non-monthly interval resets it', async () => {
+      const user = await createUser();
+      const r = (await monthly(user, '2026-01-31T09:00:00.000Z')).body;
+      const feb = await complete(user, r.id);
+      expect(localDate(feb.due_date)).toBe('2026-02-28');
+
+      // The edit form sends everything back, including the (clamped) due date
+      const resaved = await user.put(`/api/reminders/${r.id}`).send({
+        content: 'rent (edited)', due_date: feb.due_date, is_recurring: true, recurrence_interval: 'monthly'
+      });
+      expect(resaved.body).toMatchObject({ content: 'rent (edited)', recurrence_day: 31 });
+      expect(localDate((await complete(user, r.id)).due_date)).toBe('2026-03-31');
+
+      // Editing only the text keeps it too
+      expect((await user.put(`/api/reminders/${r.id}`).send({ content: 'rent again' })).body.recurrence_day).toBe(31);
+
+      // Picking a new date re-anchors on that day
+      const moved = await user.put(`/api/reminders/${r.id}`).send({ due_date: '2026-04-15T09:00:00.000Z' });
+      expect(moved.body.recurrence_day).toBe(new Date('2026-04-15T09:00:00.000Z').getDate());
+      expect(localDate((await complete(user, r.id)).due_date)).toBe('2026-05-15');
+
+      // Weekly reminders and non-recurring ones have no anchor
+      expect((await user.put(`/api/reminders/${r.id}`).send({ recurrence_interval: 'weekly' })).body.recurrence_day).toBeNull();
+      const once = (await remind(user, { content: 'once', due_date: '2026-01-31T09:00:00.000Z' })).body;
+      expect(once.recurrence_day).toBeNull();
+    });
+
+    it('a monthly reminder without an anchor (older data) anchors on its current day', async () => {
+      const user = await createUser();
+      const lead = (await user.post('/api/leads').send({ name: 'Anchor lead' })).body;
+      const created = await user.post(`/api/leads/${lead.id}/reminders`).send({
+        content: 'follow up', due_date: '2026-01-31T09:00:00.000Z', is_recurring: true, recurrence_interval: 'monthly'
+      });
+      expect(created.status).toBe(201);
+      // Lead reminders store their anchor now; clear it to simulate a row from before the column existed
+      user.db.prepare('UPDATE reminders SET recurrence_day = NULL WHERE id = ?').run(created.body.id);
+
+      const feb = await complete(user, created.body.id);
+      expect(localDate(feb.due_date)).toBe('2026-02-28');
+      expect(feb.recurrence_day).toBe(31);
+      expect(localDate((await complete(user, created.body.id)).due_date)).toBe('2026-03-31');
+    });
+
+    it('the startup backfill anchors existing monthly/yearly reminders once and leaves the rest alone', async () => {
+      const { backfillReminderRecurrenceDay } = await import('../database.js');
+      const user = await createUser();
+      const ids = {};
+      for (const [key, body] of Object.entries({
+        monthly: { content: 'm', due_date: '2026-01-31T09:00:00.000Z', is_recurring: true, recurrence_interval: 'monthly' },
+        yearly: { content: 'y', due_date: '2028-02-29T09:00:00.000Z', is_recurring: true, recurrence_interval: 'yearly' },
+        weekly: { content: 'w', due_date: '2026-01-31T09:00:00.000Z', is_recurring: true, recurrence_interval: 'weekly' },
+        once: { content: 'o', due_date: '2026-01-31T09:00:00.000Z' },
+        undated: { content: 'u', is_recurring: true, recurrence_interval: 'monthly' }
+      })) {
+        ids[key] = (await remind(user, body)).body.id;
+      }
+      // As they were before the column existed
+      const { db } = user;
+      const placeholders = Object.values(ids).map(() => '?').join(',');
+      db.prepare(`UPDATE reminders SET recurrence_day = NULL WHERE id IN (${placeholders})`).run(...Object.values(ids));
+      const anchors = () => Object.fromEntries(Object.entries(ids).map(([k, id]) => [k, db.prepare('SELECT recurrence_day FROM reminders WHERE id = ?').get(id).recurrence_day]));
+
+      expect(backfillReminderRecurrenceDay(db)).toBeGreaterThanOrEqual(2);
+      const expected = {
+        monthly: new Date('2026-01-31T09:00:00.000Z').getDate(),
+        yearly: new Date('2028-02-29T09:00:00.000Z').getDate(),
+        weekly: null,
+        once: null,
+        undated: null
+      };
+      expect(anchors()).toEqual(expected);
+      expect(backfillReminderRecurrenceDay(db)).toBe(0);
+      expect(anchors()).toEqual(expected);
+    });
   });
 
   it('a reminder whose associated record was deleted can still be edited with its full payload', async () => {
@@ -340,21 +461,34 @@ describe('planned slots', () => {
     expect(res.body).toHaveLength(365);
   });
 
-  // Bug: an end date before the start date creates nothing but still answers 201 with []
-  it.fails('rejects a series whose end date is before its start', async () => {
+  it('rejects a series whose end date is before its start', async () => {
     const user = await createUser();
     const { client } = await createClientProjectTask(user);
     const res = await slot(user, { client_id: client.id, date: '2026-06-10', duration: 60, is_recurring: true, recurrence_type: 'weekly', recurrence_end_date: '2026-06-01' });
     expect(res.status).toBe(400);
+    expect(res.body.error).toBeTruthy();
+    expect((await user.get('/api/planned-slots')).body).toEqual([]);
+
+    // Ending on the start day is a valid one-slot series
+    const sameDay = await slot(user, { client_id: client.id, date: '2026-06-10', duration: 60, is_recurring: true, recurrence_type: 'weekly', recurrence_end_date: '2026-06-10' });
+    expect(sameDay.status).toBe(201);
+    expect(sameDay.body.map(s => s.date)).toEqual(['2026-06-10']);
   });
 
-  // Bug: monthly series use Date#setMonth, so a series starting on the 31st skips/duplicates months
-  it.fails('a monthly series starting on the 31st has at most one slot per month', async () => {
+  it('a monthly series starting on the 31st has at most one slot per month', async () => {
     const user = await createUser();
     const { client } = await createClientProjectTask(user);
     const res = await slot(user, { client_id: client.id, date: '2026-01-31', duration: 60, is_recurring: true, recurrence_type: 'monthly', recurrence_end_date: '2026-06-30' });
     const months = res.body.map(s => s.date.slice(0, 7));
     expect(new Set(months).size).toBe(months.length);
+    // Clamped to the end of short months, back to the 31st whenever the month has one
+    expect(res.body.map(s => s.date)).toEqual(['2026-01-31', '2026-02-28', '2026-03-31', '2026-04-30', '2026-05-31', '2026-06-30']);
+
+    const everyOther = await slot(user, { client_id: client.id, date: '2027-12-31', duration: 60, is_recurring: true, recurrence_type: 'monthly', recurrence_interval: 2, recurrence_end_date: '2028-06-30' });
+    expect(everyOther.body.map(s => s.date)).toEqual(['2027-12-31', '2028-02-29', '2028-04-30', '2028-06-30']);
+
+    const yearly = await slot(user, { client_id: client.id, date: '2028-02-29', duration: 60, is_recurring: true, recurrence_type: 'yearly', recurrence_end_date: '2032-03-01' });
+    expect(yearly.body.map(s => s.date)).toEqual(['2028-02-29', '2029-02-28', '2030-02-28', '2031-02-28', '2032-02-29']);
   });
 
   it('updates fields, deletes one slot or a whole series', async () => {
diff --git a/server/tests/stats.test.js b/server/tests/stats.test.js
index c32095b..c15dd8c 100644
--- a/server/tests/stats.test.js
+++ b/server/tests/stats.test.js
@@ -1,4 +1,4 @@
-import { describe, it, expect } from 'vitest';
+import { describe, it, expect, vi } from 'vitest';
 import request from 'supertest';
 import { getApp, createUser } from './helpers.js';
 import { addEntry, backdateTimer } from './helpers-core.js';
@@ -101,6 +101,111 @@ describe('stats - dashboard', () => {
     expect(span.body.time.thisMonth).toBe(3600 + 1800 + 14400);
   });
 
+  // The dashboard sends the user's local calendar days as explicit instants (Israel is UTC+3 in October)
+  it('uses explicit ISO instants as-is, so local calendar days work east of UTC', async () => {
+    const user = await createUser();
+    const client = (await user.post('/api/clients').send({ name: 'C' })).body;
+    const project = (await user.post('/api/projects').send({ client_id: client.id, name: 'P' })).body;
+    // 01:00-01:30 on Oct 8 in Israel = 22:00-22:30 UTC on Oct 7
+    await addEntry(user, { project_id: project.id, start: '2026-10-07T22:00:00.000Z', seconds: 1800 });
+    // .query() encodes the "+" of an offset (a raw "+" in a URL would arrive as a space)
+    const range = async (startDate, endDate) => (await user.get('/api/stats/dashboard').query({ startDate, endDate })).body;
+
+    // Oct 8 in Israel, as the UTC ISO of local midnight / end of day
+    const oct8 = await range('2026-10-07T21:00:00.000Z', '2026-10-08T20:59:59.999Z');
+    expect(oct8.time.thisMonth).toBe(1800);
+    expect(oct8.selectedPeriod).toMatchObject({
+      startDate: '2026-10-07T21:00:00.000Z',
+      endDate: '2026-10-08T20:59:59.999Z',
+      isCustomRange: true
+    });
+
+    // The same day written with an explicit offset
+    const withOffset = await range('2026-10-08T00:00:00+03:00', '2026-10-08T23:59:59.999+03:00');
+    expect(withOffset.time.thisMonth).toBe(1800);
+    expect(withOffset.selectedPeriod.startDate).toBe('2026-10-07T21:00:00.000Z');
+    expect(withOffset.selectedPeriod.endDate).toBe('2026-10-08T20:59:59.999Z');
+
+    // Oct 7 in Israel ends at 21:00 UTC, before the entry
+    expect((await range('2026-10-06T21:00:00.000Z', '2026-10-07T20:59:59.999Z')).time.thisMonth).toBe(0);
+
+    // Plain dates still mean whole UTC days (older callers): the entry is on Oct 7 in UTC
+    expect((await range('2026-10-08', '2026-10-08')).time.thisMonth).toBe(0);
+    expect((await range('2026-10-07', '2026-10-07')).time.thisMonth).toBe(1800);
+  });
+
+  // The dashboard's month view sends the user's local month as instants, next to month/year
+  it('month mode uses the local month instants when sent, and UTC months for month/year alone', async () => {
+    const user = await createUser();
+    const client = (await user.post('/api/clients').send({ name: 'C' })).body;
+    const project = (await user.post('/api/projects').send({ client_id: client.id, name: 'P' })).body;
+    // 01:00-01:30 on Nov 1 in Israel (UTC+2 after the DST switch) = 23:00-23:30 UTC on Oct 31
+    await addEntry(user, { project_id: project.id, start: '2026-10-31T23:00:00.000Z', seconds: 1800 });
+    const get = async (query) => (await user.get('/api/stats/dashboard').query(query)).body;
+
+    // November in Israel: Nov 1 00:00 (+02:00) to Nov 30 23:59:59.999 (+02:00)
+    const nov = await get({ month: 10, year: 2026, startDate: '2026-10-31T22:00:00.000Z', endDate: '2026-11-30T21:59:59.999Z' });
+    expect(nov.time.thisMonth).toBe(1800);
+    expect(nov.selectedPeriod).toMatchObject({
+      startDate: '2026-10-31T22:00:00.000Z',
+      endDate: '2026-11-30T21:59:59.999Z',
+      isCustomRange: false
+    });
+
+    // October in Israel starts at +03:00 and ends at +02:00 - the entry is not in it
+    const oct = await get({ month: 9, year: 2026, startDate: '2026-09-30T21:00:00.000Z', endDate: '2026-10-31T21:59:59.999Z' });
+    expect(oct.time.thisMonth).toBe(0);
+
+    // month/year alone (older callers) still means the UTC month: the entry is on Oct 31 in UTC
+    expect((await get({ month: 10, year: 2026 })).time.thisMonth).toBe(0);
+    const utcOct = await get({ month: 9, year: 2026 });
+    expect(utcOct.time.thisMonth).toBe(1800);
+    expect(utcOct.selectedPeriod).toMatchObject({ startDate: '2026-10-01T00:00:00.000Z', isCustomRange: false });
+  });
+
+  it('periodIncludesToday follows the period that was sent, not the UTC day', async () => {
+    vi.useFakeTimers({ toFake: ['Date'] });
+    try {
+      // 01:30 on Oct 8 in Israel - still Oct 7 in UTC
+      vi.setSystemTime(new Date('2026-10-07T22:30:00.000Z'));
+      const user = await createUser();
+      const get = async (startDate, endDate) => (await user.get('/api/stats/dashboard').query({ startDate, endDate })).body.selectedPeriod;
+
+      expect((await get('2026-10-07T21:00:00.000Z', '2026-10-08T20:59:59.999Z')).periodIncludesToday).toBe(true); // local Oct 8
+      expect((await get('2026-10-06T21:00:00.000Z', '2026-10-07T20:59:59.999Z')).periodIncludesToday).toBe(false); // local Oct 7
+      expect((await get('2026-10-01T00:00:00+03:00', '2026-10-31T23:59:59.999+02:00')).periodIncludesToday).toBe(true);
+      // Plain dates are UTC days: now is on Oct 7 in UTC
+      expect((await get('2026-10-07', '2026-10-07')).periodIncludesToday).toBe(true);
+      expect((await get('2026-10-08', '2026-10-08')).periodIncludesToday).toBe(false);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it('a timer running since before local midnight counts its share for yesterday too', async () => {
+    vi.useFakeTimers({ toFake: ['Date'] });
+    try {
+      // 08:30 on Oct 8 in Israel; the timer started at 23:30 on Oct 7 (20:30 UTC), 9 hours ago
+      vi.setSystemTime(new Date('2026-10-08T05:30:00.000Z'));
+      const user = await createUser();
+      const client = (await user.post('/api/clients').send({ name: 'C' })).body;
+      const project = (await user.post('/api/projects').send({ client_id: client.id, name: 'P' })).body;
+      const running = (await user.post('/api/timer/start').send({ project_id: project.id })).body;
+      backdateTimer(user.db, running.id, 9 * 3600);
+      const get = async (startDate, endDate) => (await user.get('/api/stats/dashboard').query({ startDate, endDate })).body;
+
+      const yesterday = await get('2026-10-06T21:00:00.000Z', '2026-10-07T20:59:59.999Z');
+      expect(yesterday.selectedPeriod.periodIncludesToday).toBe(false);
+      near(yesterday.time.thisMonth, 1800); // 23:30-24:00
+      const today = await get('2026-10-07T21:00:00.000Z', '2026-10-08T20:59:59.999Z');
+      expect(today.selectedPeriod.periodIncludesToday).toBe(true);
+      near(today.time.thisMonth, 8.5 * 3600); // 00:00-08:30
+      near(today.time.total, 9 * 3600);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
   it('attributes a zero-span entry to its start day', async () => {
     const user = await createUser();
     const client = (await user.post('/api/clients').send({ name: 'C' })).body;
diff --git a/server/tests/workspaces-isolation.test.js b/server/tests/workspaces-isolation.test.js
index 8db7c5f..e194383 100644
--- a/server/tests/workspaces-isolation.test.js
+++ b/server/tests/workspaces-isolation.test.js
@@ -1,4 +1,6 @@
 import { describe, it, expect, beforeAll } from 'vitest';
+import fs from 'fs';
+import path from 'path';
 import request from 'supertest';
 import { getApp, createUser, createClientProjectTask } from './helpers.js';
 import { addEntry, addMember, backdateTimer } from './helpers-core.js';
@@ -375,16 +377,57 @@ describe('workspaces - CRUD', () => {
     expect((await user.get('/api/workspaces')).body.map((w) => w.id)).toEqual([user.workspaceId]);
   });
 
-  // workspace_id on clients/projects/... is a plain column without a foreign key, so the comment
-  // "CASCADE will handle ... data" in DELETE /workspaces/:id is wrong and the rows are orphaned
-  it.fails('deleting a workspace also deletes its clients, projects and entries', async () => {
+  // workspace_id on clients/projects/... is a plain column without a foreign key, so deleting only the
+  // workspaces row (relying on CASCADE) used to leave all of its data orphaned
+  it('deleting a workspace also deletes its clients, projects and entries', async () => {
     const user = await createUser();
+    const keep = await createClientProjectTask(user);
     const second = (await user.post('/api/workspaces').send({ name: 'Doomed' })).body;
-    const c = (await user.post('/api/clients', second.id).send({ name: 'Doomed client' })).body;
-    await user.post('/api/projects', second.id).send({ client_id: c.id, name: 'Doomed project' });
-    expect((await user.delete(`/api/workspaces/${second.id}`, second.id)).status).toBe(200);
-    expect(user.db.prepare('SELECT COUNT(*) AS n FROM clients WHERE workspace_id = ?').get(second.id).n).toBe(0);
-    expect(user.db.prepare('SELECT COUNT(*) AS n FROM projects WHERE workspace_id = ?').get(second.id).n).toBe(0);
+    const ws = second.id;
+    const c = (await user.post('/api/clients', ws).send({ name: 'Doomed client' })).body;
+    const p = (await user.post('/api/projects', ws).send({ client_id: c.id, name: 'Doomed project' })).body;
+    const t = (await user.post('/api/tasks', ws).send({ project_id: p.id, name: 'Doomed task' })).body;
+    await addEntry({ ...user, post: (url) => user.post(url, ws) }, { project_id: p.id, task_id: t.id, start: '2025-05-01T09:00:00.000Z', seconds: 900 });
+    await user.post('/api/timer/start', ws).send({ project_id: p.id });
+    await user.post('/api/catalog', ws).send({ name: 'Doomed item', price: 10 });
+    await user.put('/api/addons/catalog', ws).send({ isEnabled: true });
+    await user.put('/api/addons/ai_assistant/settings', ws).send({ openai_api_key: 'sk-doomed-1234567890' });
+    await user.post('/api/client-sources', ws).send({ name: `Doomed source ${Date.now()}` });
+    await user.post(`/api/workspaces/${ws}/invites`, ws).send({});
+
+    // An uploaded file of the workspace, on disk and in the files table
+    const storedName = `doomed-${Date.now()}.txt`;
+    fs.mkdirSync(process.env.CLOCKWIZE_UPLOADS_DIR, { recursive: true });
+    const storedPath = path.join(process.env.CLOCKWIZE_UPLOADS_DIR, storedName);
+    fs.writeFileSync(storedPath, 'doomed');
+    user.db.prepare(`
+      INSERT INTO files (id, user_id, workspace_id, client_id, original_name, storage_path)
+      VALUES (?, ?, ?, ?, 'doomed.txt', ?)
+    `).run(`file-${Date.now()}`, user.user.id, ws, c.id, storedName);
+
+    const { db } = user;
+    const workspaceTables = db.prepare(`
+      SELECT m.name FROM sqlite_master m
+      WHERE m.type = 'table' AND EXISTS (SELECT 1 FROM pragma_table_info(m.name) WHERE name = 'workspace_id')
+    `).all().map((r) => r.name);
+    const rowsIn = (workspaceId) => Object.fromEntries(workspaceTables
+      .map((table) => [table, db.prepare(`SELECT COUNT(*) AS n FROM ${table} WHERE workspace_id = ?`).get(workspaceId).n])
+      .filter(([, n]) => n > 0));
+    const otherBefore = rowsIn(user.workspaceId);
+    expect(Object.keys(rowsIn(ws)).length).toBeGreaterThan(10);
+
+    expect((await user.delete(`/api/workspaces/${ws}`, ws)).status).toBe(200);
+
+    expect(rowsIn(ws)).toEqual({});
+    expect(db.prepare('SELECT COUNT(*) AS n FROM workspaces WHERE id = ?').get(ws).n).toBe(0);
+    for (const [table, id] of [['clients', c.id], ['projects', p.id], ['tasks', t.id]]) {
+      expect(db.prepare(`SELECT COUNT(*) AS n FROM ${table} WHERE id = ?`).get(id).n, table).toBe(0);
+    }
+    expect(fs.existsSync(storedPath)).toBe(false);
+
+    // The user's other workspace is untouched
+    expect(rowsIn(user.workspaceId)).toEqual(otherBefore);
+    expect((await user.get(`/api/clients/${keep.client.id}`)).status).toBe(200);
   });
 });
 
diff --git a/server/utils/authSession.js b/server/utils/authSession.js
new file mode 100644
index 0000000..7d01942
--- /dev/null
+++ b/server/utils/authSession.js
@@ -0,0 +1,45 @@
+import { generateToken, generatePasswordResetToken } from '../middleware/auth.js';
+import { saveLocalSession } from './localSession.js';
+
+// The user's workspaces in the order login picks the default one from (oldest membership first)
+export const getUserWorkspaces = (db, userId) => db.prepare(`
+  SELECT w.*, wm.role,
+    (SELECT COUNT(*) FROM workspace_members WHERE workspace_id = w.id) as member_count
+  FROM workspaces w
+  JOIN workspace_members wm ON w.id = wm.workspace_id
+  WHERE wm.user_id = ?
+  ORDER BY wm.joined_at ASC
+`).all(userId);
+
+// A signed-in session: a normal token, the user, their workspaces and the default workspace.
+// Also hands the session to the desktop / menu-bar app (local session file).
+export const buildAuthResponse = (db, user) => {
+  const token = generateToken(user.id);
+  const workspaces = getUserWorkspaces(db, user.id);
+  const currentWorkspace = workspaces[0] || null;
+  if (currentWorkspace) {
+    saveLocalSession(token, currentWorkspace.id);
+  }
+  return {
+    user: {
+      id: user.id,
+      email: user.email,
+      name: user.name,
+      default_hourly_rate: user.default_hourly_rate,
+      is_admin: user.is_admin || 0,
+      // 0 for passkey-only accounts (they confirm account deletion with their email, not a password)
+      has_password: user.password ? 1 : 0
+    },
+    token,
+    requiresPasswordReset: false,
+    workspaces,
+    currentWorkspace
+  };
+};
+
+// The admin flagged this user for a forced password reset: no session (no token, nothing saved for
+// the desktop app) until they set a new password with this short-lived reset token
+export const buildPasswordResetRequiredResponse = (user) => ({
+  requiresPasswordReset: true,
+  resetToken: generatePasswordResetToken(user.id)
+});
diff --git a/server/utils/recurrence.js b/server/utils/recurrence.js
new file mode 100644
index 0000000..f5ef19b
--- /dev/null
+++ b/server/utils/recurrence.js
@@ -0,0 +1,12 @@
+// Monthly/yearly reminders keep the day of the month they were set for (reminders.recurrence_day),
+// so 31.1 -> 28.2 -> 31.3 instead of drifting to the 28th after one short month.
+// Shared by routes/reminders.js and the lead reminders in routes/leads.js.
+export const ANCHORED_INTERVALS = ['monthly', 'yearly'];
+
+export const dayOfMonth = (value) => {
+  const date = new Date(value);
+  return Number.isNaN(date.getTime()) ? null : date.getDate();
+};
+
+export const recurrenceDayFor = ({ is_recurring, recurrence_interval, due_date }) =>
+  is_recurring && ANCHORED_INTERVALS.includes(recurrence_interval) && due_date ? dayOfMonth(due_date) : null;