diff --git a/platform/app.py b/platform/app.py
index 59df788..d9e50b0 100644
--- a/platform/app.py
+++ b/platform/app.py
@@ -4,10 +4,17 @@ import subprocess
 import threading
 import uuid
 import time
-from config import MAIN_SERVER_IP, VM_HOST, VM_PORT, VM_KEY, VM_USER, RUNNING_ON_MAIN_SERVER
+from config import MAIN_SERVER_IP, VM_HOST, VM_PORT, VM_KEY, VM_USER
 from modules.auth import login_required
-from modules.backups import get_containers, get_local_backups, get_vm_backups
+from modules.backups import (
+    get_containers, get_all_root_containers, get_local_backups,
+    get_vm_backups, get_all_stats, get_system_info
+)
 from modules.commands import run_command, run_ssh_to_vm
+from modules.users import (
+    get_all_users, get_user_containers, get_all_users_containers,
+    create_user, delete_user, get_user_disk_usage
+)
 
 app = Flask(__name__)
 app.secret_key = 'navitrends-secret-key-2025'
@@ -33,6 +40,9 @@ def _stream_restore(job_id, cmd):
         restore_jobs[job_id]['status'] = 'error'
 
 
+# ─────────────────────────────────────────────
+# DASHBOARD
+# ─────────────────────────────────────────────
 @app.route('/')
 @login_required
 def dashboard():
@@ -40,14 +50,121 @@ def dashboard():
     running_count = sum(1 for c in containers if 'Up' in c.get('status', ''))
     backups = get_local_backups()
     vm_backups = get_vm_backups()
+    system = get_system_info()
+    users = get_all_users()
     return render_template('dashboard.html',
                            containers=containers,
                            running_count=running_count,
                            backups=backups,
                            vm_backups=vm_backups,
-                           main_server=MAIN_SERVER_IP)
+                           main_server=MAIN_SERVER_IP,
+                           system=system,
+                           users=users)
 
 
+# ─────────────────────────────────────────────
+# API — system info + stats (live poll)
+# ─────────────────────────────────────────────
+@app.route('/api/system')
+@login_required
+def api_system():
+    return jsonify(get_system_info())
+
+
+@app.route('/api/stats')
+@login_required
+def api_stats():
+    """Container resource stats for ALL containers (root + rootless users)."""
+    return jsonify(get_all_stats())
+
+
+@app.route('/api/containers')
+@login_required
+def api_containers():
+    containers = get_all_root_containers()
+    running_count = sum(1 for c in containers if 'Up' in c.get('status', ''))
+    return jsonify({'containers': containers, 'running': running_count})
+
+
+@app.route('/api/containers/all')
+@login_required
+def api_containers_all():
+    """Root containers + all users' rootless containers combined."""
+    root_ctrs  = get_all_root_containers()
+    user_ctrs  = get_all_users_containers()
+    all_ctrs   = root_ctrs + user_ctrs
+    running    = sum(1 for c in all_ctrs if 'Up' in c.get('status', ''))
+    return jsonify({'containers': all_ctrs, 'running': running})
+
+
+# ─────────────────────────────────────────────
+# API — backups
+# ─────────────────────────────────────────────
+@app.route('/api/backups')
+@login_required
+def api_backups():
+    return jsonify({'local': get_local_backups(), 'vm': get_vm_backups()})
+
+
+# ─────────────────────────────────────────────
+# API — users management
+# ─────────────────────────────────────────────
+@app.route('/api/users')
+@login_required
+def api_users():
+    return jsonify(get_all_users())
+
+
+@app.route('/api/users/<username>/containers')
+@login_required
+def api_user_containers(username):
+    return jsonify(get_user_containers(username))
+
+
+@app.route('/api/users/<username>/disk')
+@login_required
+def api_user_disk(username):
+    return jsonify(get_user_disk_usage(username))
+
+
+@app.route('/api/users/create', methods=['POST'])
+@login_required
+def api_create_user():
+    data = request.get_json() or {}
+    username      = data.get('username', '').strip()
+    password      = data.get('password', '').strip()
+    setup_docker  = data.get('setup_docker', True)
+    disk_quota_mb = data.get('disk_quota_mb')
+
+    if not username:
+        return jsonify({'success': False, 'message': 'Username required'}), 400
+
+    success, message = create_user(
+        username=username,
+        password=password or None,
+        setup_docker=setup_docker,
+        disk_quota_mb=disk_quota_mb,
+    )
+    return jsonify({'success': success, 'message': message})
+
+
+@app.route('/api/users/delete', methods=['POST'])
+@login_required
+def api_delete_user():
+    data = request.get_json() or {}
+    username    = data.get('username', '').strip()
+    remove_home = data.get('remove_home', False)
+
+    if not username:
+        return jsonify({'success': False, 'message': 'Username required'}), 400
+
+    success, message = delete_user(username, remove_home=remove_home)
+    return jsonify({'success': success, 'message': message})
+
+
+# ─────────────────────────────────────────────
+# RESTORE
+# ─────────────────────────────────────────────
 @app.route('/restore/start', methods=['POST'])
 @login_required
 def restore_start():
@@ -68,41 +185,22 @@ def restore_start():
     if not backup_file:
         return jsonify({'error': 'No backup file specified'}), 400
 
-    # ── Resolve backup archive path on THIS server ───────────────────────────
+    # Resolve archive path on this server
     if backup_source == 'local':
-        # Local path depends on which server we're running on
-        if RUNNING_ON_MAIN_SERVER:
-            backup_path = f"/root/backups/{backup_file}"
-        else:
-            backup_path = f"/backups/main-server/{backup_file}"
-
+        backup_path = f"/root/backups/{backup_file}"
         if not os.path.exists(backup_path):
             return jsonify({'error': f'Backup not found: {backup_path}'}), 400
-
     else:
-        # "Other server" backup source — pull it to /tmp/ first
         backup_path = f"/tmp/{backup_file}"
         if not os.path.exists(backup_path):
-            if RUNNING_ON_MAIN_SERVER:
-                # Original logic: pull from VM via SSH tunnel (port 2223)
-                pull_cmd = (
-                    f"scp -i {VM_KEY} -P {VM_PORT} "
-                    f"-o StrictHostKeyChecking=no -o ConnectTimeout=15 "
-                    f"{VM_USER}@{VM_HOST}:/backups/main-server/{backup_file} "
-                    f"{backup_path}"
-                )
-            else:
-                # On VM: pull from main server's /root/backups/ via port 22
-                pull_cmd = (
-                    f"scp -i {VM_KEY} -P 22 "
-                    f"-o StrictHostKeyChecking=no -o ConnectTimeout=15 "
-                    f"{VM_USER}@{MAIN_SERVER_IP}:/root/backups/{backup_file} "
-                    f"{backup_path}"
-                )
-
+            pull_cmd = (
+                f"scp -i {VM_KEY} -P {VM_PORT} "
+                f"-o StrictHostKeyChecking=no -o ConnectTimeout=15 "
+                f"{VM_USER}@{VM_HOST}:/backups/main-server/{backup_file} {backup_path}"
+            )
             result = subprocess.run(pull_cmd, shell=True, capture_output=True, text=True)
             if result.returncode != 0:
-                return jsonify({'error': f'Failed to pull backup: {result.stderr}'}), 500
+                return jsonify({'error': f'Failed to pull from VM: {result.stderr}'}), 500
 
     restore_script_local = os.path.join(
         os.path.dirname(os.path.abspath(__file__)), 'restore-myapps.sh'
@@ -110,60 +208,48 @@ def restore_start():
     if not os.path.exists(restore_script_local):
         return jsonify({'error': f'restore-myapps.sh not found at {restore_script_local}'}), 500
 
-    # ── Build command ────────────────────────────────────────────────────────
     if target == 'local':
         session_dir = f"/tmp/restore-session-{uuid.uuid4().hex[:8]}"
         cmd = (
-            f"set -e && "
-            f"mkdir -p {session_dir} && "
+            f"set -e && mkdir -p {session_dir} && "
             f"echo '📂 Extracting backup locally...' && "
             f"tar -xzf {backup_path} -C {session_dir} --strip-components=1 && "
             f"cp {restore_script_local} {session_dir}/restore-myapps.sh && "
             f"chmod +x {session_dir}/restore-myapps.sh && "
-            f"cd {session_dir} && "
-            f"bash restore-myapps.sh ; "
+            f"cd {session_dir} && bash restore-myapps.sh ; "
             f"EXIT=$? ; rm -rf {session_dir} ; exit $EXIT"
         )
-
     else:
         if not remote_ip:
-            return jsonify({'error': 'remote_ip is required for remote restore'}), 400
-
-        base_ssh_opts = f"-o StrictHostKeyChecking=no -o ConnectTimeout=15"
+            return jsonify({'error': 'remote_ip required for remote restore'}), 400
 
+        base_opts = "-o StrictHostKeyChecking=no -o ConnectTimeout=15"
         if auth_method == 'key':
             if not ssh_key_path:
-                return jsonify({'error': 'ssh_key_path is required'}), 400
-            ssh_prefix = f"ssh -p {remote_port} -i {ssh_key_path} {base_ssh_opts}"
-            scp_prefix = f"scp -P {remote_port} -i {ssh_key_path} {base_ssh_opts}"
+                return jsonify({'error': 'ssh_key_path required'}), 400
+            ssh_prefix = f"ssh -p {remote_port} -i {ssh_key_path} {base_opts}"
+            scp_prefix = f"scp -P {remote_port} -i {ssh_key_path} {base_opts}"
         else:
             if not ssh_password:
-                return jsonify({'error': 'ssh_password is required'}), 400
-            ssh_prefix = f"sshpass -p '{ssh_password}' ssh -p {remote_port} {base_ssh_opts}"
-            scp_prefix = f"sshpass -p '{ssh_password}' scp -P {remote_port} {base_ssh_opts}"
+                return jsonify({'error': 'ssh_password required'}), 400
+            ssh_prefix = f"sshpass -p '{ssh_password}' ssh -p {remote_port} {base_opts}"
+            scp_prefix = f"sshpass -p '{ssh_password}' scp -P {remote_port} {base_opts}"
 
         remote_dest = f"/backups/restore-session-{uuid.uuid4().hex[:8]}"
-
         cmd = (
             f"echo '🔗 Connecting to {remote_user}@{remote_ip}:{remote_port}...' && "
             f"{ssh_prefix} {remote_user}@{remote_ip} 'mkdir -p {remote_dest}' && "
             f"echo '✅ Connected.' && "
-
-            f"echo '📤 Copying backup archive to {remote_ip}:{remote_port}...' && "
+            f"echo '📤 Copying backup archive...' && "
             f"{scp_prefix} {backup_path} {remote_user}@{remote_ip}:{remote_dest}/{backup_file} && "
-
             f"echo '📤 Copying restore script...' && "
             f"{scp_prefix} {restore_script_local} {remote_user}@{remote_ip}:{remote_dest}/restore-myapps.sh && "
-
             f"echo '🚀 Running restore on {remote_ip}:{remote_port}...' && "
             f"{ssh_prefix} {remote_user}@{remote_ip} "
-            f"'set -e && "
-            f"cd {remote_dest} && "
+            f"'set -e && cd {remote_dest} && "
             f"echo \"📂 Extracting backup...\" && "
             f"tar -xzf {backup_file} --strip-components=1 && "
-            f"chmod +x restore-myapps.sh && "
-            f"bash restore-myapps.sh' ; "
-
+            f"chmod +x restore-myapps.sh && bash restore-myapps.sh' ; "
             f"EXIT=$? ; "
             f"{ssh_prefix} {remote_user}@{remote_ip} 'rm -rf {remote_dest}' 2>/dev/null ; "
             f"exit $EXIT"
@@ -172,7 +258,6 @@ def restore_start():
     job_id = str(uuid.uuid4())
     t = threading.Thread(target=_stream_restore, args=(job_id, cmd), daemon=True)
     t.start()
-
     return jsonify({'job_id': job_id, 'status': 'started'})
 
 
@@ -189,22 +274,9 @@ def restore_status_poll(job_id):
     })
 
 
-@app.route('/api/backups')
-@login_required
-def api_backups():
-    return jsonify({'local': get_local_backups(), 'vm': get_vm_backups()})
-
-
-@app.route('/api/containers')
-@login_required
-def api_containers():
-    containers = get_containers()
-    return jsonify({
-        'containers': containers,
-        'running': sum(1 for c in containers if 'Up' in c.get('status', ''))
-    })
-
-
+# ─────────────────────────────────────────────
+# SERVER STATUS
+# ─────────────────────────────────────────────
 @app.route('/server/status')
 @login_required
 def server_status():
@@ -214,6 +286,9 @@ def server_status():
     return jsonify({'status': 'online', 'info': stdout.strip()})
 
 
+# ─────────────────────────────────────────────
+# AUTH
+# ─────────────────────────────────────────────
 @app.route('/login', methods=['GET', 'POST'])
 def login():
     error = ''
diff --git a/platform/modules/backups.py b/platform/modules/backups.py
index 8041c7e..1eef9b5 100644
--- a/platform/modules/backups.py
+++ b/platform/modules/backups.py
@@ -1,31 +1,27 @@
 import os
 import glob
 import subprocess
-from config import RUNNING_ON_MAIN_SERVER, VM_HOST, VM_PORT, VM_KEY, VM_USER, MAIN_SERVER_IP
+import json
+from config import RUNNING_ON_MAIN_SERVER, VM_HOST, VM_PORT, VM_KEY, VM_USER
 
 
-def run_command(cmd):
+def _run(cmd, timeout=20):
     try:
-        result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=30)
-        return result.stdout, result.stderr
+        r = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)
+        return r.stdout.strip(), r.stderr.strip()
     except Exception as e:
         return '', str(e)
 
 
-def get_local_backups():
-    """
-    On main server → /root/backups/  (backups of the main server, stored locally)
-    On VM          → /backups/main-server/  (backups of the main server, stored on VM)
-    """
-    if RUNNING_ON_MAIN_SERVER:
-        path = "/root/backups/myapps-backup-*.tar.gz"
-    else:
-        path = "/backups/main-server/myapps-backup-*.tar.gz"
+# ────────────────────────────────────────────────────────────────
+# BACKUPS
+# ────────────────────────────────────────────────────────────────
 
-    stdout, _ = run_command(f"ls -t {path} 2>/dev/null | head -20")
+def get_local_backups():
+    stdout, _ = _run("ls -t /root/backups/myapps-backup-*.tar.gz 2>/dev/null | head -20")
     files = []
     if stdout:
-        for line in stdout.strip().split('\n'):
+        for line in stdout.split('\n'):
             line = line.strip()
             if line:
                 files.append(os.path.basename(line))
@@ -33,14 +29,8 @@ def get_local_backups():
 
 
 def get_vm_backups():
-    """
-    On main server → SSH into VM (via tunnel port 2223) to list /backups/main-server/
-    On VM          → SSH into main server (port 22) to list /root/backups/
-    """
-    backups = []
-
+    vm_backups = []
     if RUNNING_ON_MAIN_SERVER:
-        # Original logic — unchanged
         try:
             cmd = (
                 f"ssh -i {VM_KEY} -p {VM_PORT} "
@@ -48,58 +38,143 @@ def get_vm_backups():
                 f"{VM_USER}@{VM_HOST} "
                 f"'ls -t /backups/main-server/myapps-backup-*.tar.gz 2>/dev/null | head -20'"
             )
-            stdout, _ = run_command(cmd)
+            stdout, _ = _run(cmd, timeout=20)
             if stdout:
-                for line in stdout.strip().split('\n'):
+                for line in stdout.split('\n'):
                     line = line.strip()
                     if line and '.tar.gz' in line:
-                        backups.append(os.path.basename(line))
+                        vm_backups.append(os.path.basename(line))
         except Exception as e:
-            print(f"[backups] Error fetching VM backups: {e}")
-
+            print(f"[backups] VM backup fetch error: {e}")
     else:
-        # Running on VM → SSH into main server to list its local backups
-        try:
-            cmd = (
-                f"ssh -i {VM_KEY} -p 22 "
-                f"-o StrictHostKeyChecking=no -o ConnectTimeout=10 "
-                f"{VM_USER}@{MAIN_SERVER_IP} "
-                f"'ls -t /root/backups/myapps-backup-*.tar.gz 2>/dev/null | head -20'"
-            )
-            stdout, _ = run_command(cmd)
-            if stdout:
-                for line in stdout.strip().split('\n'):
-                    line = line.strip()
-                    if line and '.tar.gz' in line:
-                        backups.append(os.path.basename(line))
-        except Exception as e:
-            print(f"[backups] Error fetching main server backups from VM: {e}")
+        backup_dir = '/backups/main-server'
+        if os.path.exists(backup_dir):
+            files = glob.glob(f'{backup_dir}/myapps-backup-*.tar.gz')
+            files.sort(key=os.path.getmtime, reverse=True)
+            vm_backups = [os.path.basename(f) for f in files[:20]]
+    return vm_backups
 
-    return backups
 
+# ────────────────────────────────────────────────────────────────
+# ROOT CONTAINERS
+# ────────────────────────────────────────────────────────────────
 
 def get_containers():
-    """
-    On main server → local docker ps  (original, unchanged)
-    On VM          → SSH into main server to get its containers
-    """
-    if RUNNING_ON_MAIN_SERVER:
-        stdout, _ = run_command(
-            "docker ps -a --format '{{.Names}}|{{.Status}}' 2>/dev/null"
+    """Root app containers only (filtered)."""
+    stdout, _ = _run(
+        "docker ps -a --format '{{.Names}}|{{.Status}}|{{.Image}}|{{.Ports}}' 2>/dev/null | "
+        "grep -E 'frappe|nextcloud|mautic|n8n|odoo'"
+    )
+    containers = []
+    if stdout:
+        for line in stdout.split('\n'):
+            if '|' not in line:
+                continue
+            parts = line.split('|')
+            containers.append({
+                'name':   parts[0].strip(),
+                'status': parts[1].strip(),
+                'image':  parts[2].strip(),
+                'ports':  parts[3].strip() if len(parts) > 3 else '',
+                'owner':  'root',
+            })
+    return containers
+
+
+def get_all_root_containers():
+    """ALL root docker containers (unfiltered)."""
+    stdout, _ = _run(
+        "docker ps -a --format '{{.Names}}|{{.Status}}|{{.Image}}|{{.Ports}}' 2>/dev/null"
+    )
+    containers = []
+    if stdout:
+        for line in stdout.split('\n'):
+            if '|' not in line:
+                continue
+            parts = line.split('|')
+            containers.append({
+                'name':   parts[0].strip(),
+                'status': parts[1].strip(),
+                'image':  parts[2].strip(),
+                'ports':  parts[3].strip() if len(parts) > 3 else '',
+                'owner':  'root',
+            })
+    return containers
+
+
+# ────────────────────────────────────────────────────────────────
+# CONTAINER STATS
+# ────────────────────────────────────────────────────────────────
+
+def get_container_stats(docker_socket=None):
+    """One-shot stats snapshot. Returns dict keyed by container name."""
+    if docker_socket:
+        cmd = (
+            f"DOCKER_HOST=unix://{docker_socket} "
+            f"docker stats --no-stream --format "
+            f"'{{{{.Name}}}}|{{{{.CPUPerc}}}}|{{{{.MemUsage}}}}|{{{{.MemPerc}}}}|{{{{.NetIO}}}}|{{{{.BlockIO}}}}' 2>/dev/null"
         )
     else:
         cmd = (
-            f"ssh -i {VM_KEY} -p 22 "
-            f"-o StrictHostKeyChecking=no -o ConnectTimeout=10 "
-            f"{VM_USER}@{MAIN_SERVER_IP} "
-            f"\"docker ps -a --format '{{{{.Names}}}}|{{{{.Status}}}}' 2>/dev/null\""
+            "docker stats --no-stream --format "
+            "'{{.Name}}|{{.CPUPerc}}|{{.MemUsage}}|{{.MemPerc}}|{{.NetIO}}|{{.BlockIO}}' 2>/dev/null"
         )
-        stdout, _ = run_command(cmd)
 
-    containers = []
+    stdout, _ = _run(cmd, timeout=30)
+    stats = {}
     if stdout:
-        for line in stdout.strip().split('\n'):
-            if '|' in line:
-                name, status = line.split('|', 1)
-                containers.append({'name': name.strip(), 'status': status.strip()})
-    return containers
+        for line in stdout.split('\n'):
+            if '|' not in line:
+                continue
+            parts = line.split('|')
+            if len(parts) < 6:
+                continue
+            name = parts[0].strip()
+            stats[name] = {
+                'cpu':     parts[1].strip(),
+                'mem':     parts[2].strip(),
+                'mem_pct': parts[3].strip(),
+                'net':     parts[4].strip(),
+                'block':   parts[5].strip(),
+            }
+    return stats
+
+
+def get_all_stats():
+    """Stats for root + all rootless-user containers combined."""
+    all_stats = get_container_stats()
+    try:
+        import pwd
+        for pw in pwd.getpwall():
+            if pw.pw_uid < 1000 or pw.pw_name == 'nobody':
+                continue
+            sock = f"/run/user/{pw.pw_uid}/docker.sock"
+            if os.path.exists(sock):
+                user_stats = get_container_stats(docker_socket=sock)
+                all_stats.update(user_stats)
+    except Exception as e:
+        print(f"[stats] Error: {e}")
+    return all_stats
+
+
+def get_system_info():
+    """Host-level system stats."""
+    cpu_out, _    = _run("top -bn1 | grep 'Cpu(s)' | awk '{print $2+$4}'")
+    mem_out, _    = _run("free -m | awk 'NR==2{printf \"%s/%sMB\", $3, $2}'")
+    mem_pct, _    = _run("free | awk 'NR==2{printf \"%.0f\", $3/$2*100}'")
+    disk_out, _   = _run("df -h / | awk 'NR==2{printf \"%s/%s\", $3, $2}'")
+    disk_pct, _   = _run("df / | awk 'NR==2{print $5}' | tr -d '%'")
+    load_out, _   = _run("cat /proc/loadavg | awk '{print $1, $2, $3}'")
+    uptime_out, _ = _run("uptime -p")
+    docker_v, _   = _run("docker --version | cut -d' ' -f3 | tr -d ','")
+
+    return {
+        'cpu_pct':  cpu_out or '0',
+        'memory':   mem_out or 'N/A',
+        'mem_pct':  mem_pct or '0',
+        'disk':     disk_out or 'N/A',
+        'disk_pct': disk_pct or '0',
+        'load':     load_out or 'N/A',
+        'uptime':   uptime_out or 'N/A',
+        'docker_v': docker_v or 'N/A',
+    }
diff --git a/platform/modules/users.py b/platform/modules/users.py
new file mode 100644
index 0000000..ea4c2bb
--- /dev/null
+++ b/platform/modules/users.py
@@ -0,0 +1,455 @@
+import os
+import subprocess
+import pwd
+import re
+import tempfile
+import stat
+
+
+def _run(cmd, timeout=20):
+    try:
+        r = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)
+        return r.stdout.strip(), r.stderr.strip()
+    except subprocess.TimeoutExpired:
+        return '', 'timeout'
+    except Exception as e:
+        return '', str(e)
+
+
+def get_all_users():
+    """Return list of non-system users (uid >= 1000) with info."""
+    users = []
+    try:
+        for pw in pwd.getpwall():
+            if pw.pw_uid < 1000 or pw.pw_name == 'nobody':
+                continue
+            uid  = pw.pw_uid
+            name = pw.pw_name
+            home = pw.pw_dir
+
+            sock       = f"/run/user/{uid}/docker.sock"
+            has_docker = os.path.exists(sock)
+
+            disk_out, _ = _run(f"du -sh {home} 2>/dev/null | cut -f1")
+            disk_used   = disk_out.strip() or 'N/A'
+
+            linger_out, _ = _run(f"loginctl show-user {name} --property=Linger 2>/dev/null")
+            linger = 'yes' in linger_out.lower()
+
+            container_count = 0
+            if has_docker:
+                cnt_out, _ = _run(
+                    f"DOCKER_HOST=unix://{sock} docker ps -aq 2>/dev/null | wc -l"
+                )
+                try:
+                    container_count = int(cnt_out.strip())
+                except ValueError:
+                    container_count = 0
+
+            # Check if user has a dedicated virtual disk mounted
+            disk_img    = f"/home/{name}.img"
+            has_vdisk   = os.path.exists(disk_img)
+            vdisk_mount = None
+            vdisk_size  = None
+            if has_vdisk:
+                # Check if it's mounted somewhere
+                mnt_out, _ = _run(f"findmnt -S {disk_img} -o TARGET --noheadings 2>/dev/null")
+                vdisk_mount = mnt_out.strip() or None
+                # Get size of the image
+                size_out, _ = _run(f"du -sh {disk_img} 2>/dev/null | cut -f1")
+                vdisk_size = size_out.strip() or None
+
+            users.append({
+                'name':            name,
+                'uid':             uid,
+                'home':            home,
+                'has_docker':      has_docker,
+                'docker_socket':   sock if has_docker else None,
+                'disk_used':       disk_used,
+                'linger':          linger,
+                'container_count': container_count,
+                'has_vdisk':       has_vdisk,
+                'vdisk_mount':     vdisk_mount,
+                'vdisk_size':      vdisk_size,
+            })
+    except Exception as e:
+        print(f"[users] Error listing users: {e}")
+    return users
+
+
+def get_user_containers(username):
+    """Get containers running under a specific user's rootless docker."""
+    try:
+        pw = pwd.getpwnam(username)
+    except KeyError:
+        return []
+
+    uid  = pw.pw_uid
+    sock = f"/run/user/{uid}/docker.sock"
+    if not os.path.exists(sock):
+        return []
+
+    out, _ = _run(
+        f"DOCKER_HOST=unix://{sock} "
+        f"docker ps -a --format '{{{{.Names}}}}|{{{{.Status}}}}|{{{{.Image}}}}|{{{{.Ports}}}}' 2>/dev/null"
+    )
+    containers = []
+    if out:
+        for line in out.split('\n'):
+            if '|' not in line:
+                continue
+            parts = line.split('|')
+            containers.append({
+                'name':   parts[0] if len(parts) > 0 else '',
+                'status': parts[1] if len(parts) > 1 else '',
+                'image':  parts[2] if len(parts) > 2 else '',
+                'ports':  parts[3] if len(parts) > 3 else '',
+                'owner':  username,
+            })
+    return containers
+
+
+def get_all_users_containers():
+    """Get containers from ALL users' rootless docker instances."""
+    all_containers = []
+    for user in get_all_users():
+        if user['has_docker']:
+            all_containers.extend(get_user_containers(user['name']))
+    return all_containers
+
+
+def create_user(username, password=None, setup_docker=True, disk_quota_mb=None):
+    """
+    Create a new system user and optionally set up rootless docker + virtual disk.
+    disk_quota_mb: if set, creates a loop-device virtual disk of that size (MB)
+                   and mounts it as the user's home directory.
+    Returns (success: bool, log_text: str)
+    """
+    logs = []
+
+    # Validate
+    if not re.match(r'^[a-z][a-z0-9_-]{1,30}$', username):
+        return False, "Invalid username. Use lowercase letters, numbers, _ or -"
+
+    # Check existence
+    try:
+        pwd.getpwnam(username)
+        return False, f"User '{username}' already exists"
+    except KeyError:
+        pass
+
+    # Create user
+    out, err = _run(f"useradd -m -s /bin/bash {username}")
+    if err and 'already exists' not in err:
+        return False, f"useradd failed: {err}"
+    logs.append(f"✅ User {username} created")
+
+    # Set password
+    if password:
+        out, err = _run(f"echo '{username}:{password}' | chpasswd")
+        if err:
+            logs.append(f"⚠️ Password set failed: {err}")
+        else:
+            logs.append("✅ Password set")
+
+    # Install prerequisites
+    _run("apt-get install -y uidmap dbus-user-session curl 2>/dev/null", timeout=60)
+    logs.append("✅ Prerequisites ready")
+
+    # Enable linger
+    _run(f"loginctl enable-linger {username}")
+    logs.append("✅ Linger enabled")
+
+    # Virtual disk (loop device) instead of quota
+    if disk_quota_mb:
+        success, msg = _setup_virtual_disk(username, disk_quota_mb, logs)
+        if not success:
+            logs.append(f"⚠️ Virtual disk setup failed: {msg}")
+
+    # Setup rootless docker
+    if setup_docker:
+        success, msg = _setup_rootless_docker_via_script(username, logs)
+        if not success:
+            logs.append(f"⚠️ Docker setup incomplete: {msg}")
+
+    return True, '\n'.join(logs)
+
+
+def _setup_virtual_disk(username, disk_mb, logs):
+    """
+    Create a loop-device virtual disk for a user and mount it as their home.
+
+    Steps:
+      1. Create a blank image file at /home/<username>.img
+      2. Format it as ext4
+      3. Copy existing home contents into it
+      4. Mount it over /home/<username>
+      5. Add to /etc/fstab for persistence across reboots
+      6. Fix ownership
+
+    Returns (success: bool, message: str)
+    """
+    try:
+        pw = pwd.getpwnam(username)
+    except KeyError as e:
+        return False, str(e)
+
+    home     = pw.pw_dir          # e.g. /home/secuser4
+    img_path = f"/home/{username}.img"
+
+    logs.append(f"📦 Creating {disk_mb} MB virtual disk at {img_path} ...")
+
+    # ── Step 1: Create the blank image ──────────────────────────────────────
+    # Use fallocate (fast, instant) with dd fallback
+    out, err = _run(f"fallocate -l {disk_mb}M {img_path}", timeout=60)
+    if err and 'fallocate' in err:
+        logs.append("  ↳ fallocate not available, using dd (this may take a moment)...")
+        out, err = _run(
+            f"dd if=/dev/zero of={img_path} bs=1M count={disk_mb} status=none",
+            timeout=600
+        )
+    if err:
+        return False, f"Failed to create image: {err}"
+    logs.append(f"  ✅ Image file created ({disk_mb} MB)")
+
+    # ── Step 2: Format as ext4 ───────────────────────────────────────────────
+    out, err = _run(f"mkfs.ext4 -F {img_path}", timeout=60)
+    if err and 'mke2fs' not in err and 'Discarding device blocks' not in err:
+        # mkfs.ext4 writes info to stderr even on success; only fail on real errors
+        if 'error' in err.lower() or 'failed' in err.lower():
+            return False, f"mkfs.ext4 failed: {err}"
+    logs.append("  ✅ Formatted as ext4")
+
+    # ── Step 3: Back up current home contents ────────────────────────────────
+    tmp_backup = f"/tmp/{username}_home_backup"
+    _run(f"cp -a {home}/. {tmp_backup}/ 2>/dev/null")
+
+    # ── Step 4: Mount the image over the user's home ─────────────────────────
+    out, err = _run(f"mount -o loop {img_path} {home}")
+    if err:
+        return False, f"mount failed: {err}"
+    logs.append(f"  ✅ Mounted at {home}")
+
+    # ── Step 5: Restore home contents into the new disk ──────────────────────
+    _run(f"cp -a {tmp_backup}/. {home}/ 2>/dev/null")
+    _run(f"rm -rf {tmp_backup}")
+
+    # ── Step 6: Fix ownership ─────────────────────────────────────────────────
+    _run(f"chown -R {username}:{username} {home}")
+    logs.append("  ✅ Ownership set")
+
+    # ── Step 7: Add to /etc/fstab for persistence ────────────────────────────
+    fstab_line = f"{img_path} {home} ext4 loop,defaults 0 0\n"
+    try:
+        with open('/etc/fstab', 'r') as f:
+            fstab = f.read()
+        if img_path not in fstab:
+            with open('/etc/fstab', 'a') as f:
+                f.write(fstab_line)
+            logs.append("  ✅ Added to /etc/fstab (persistent across reboots)")
+        else:
+            logs.append("  ℹ️ Already in /etc/fstab")
+    except Exception as e:
+        logs.append(f"  ⚠️ Could not update /etc/fstab: {e}")
+
+    logs.append(f"✅ Virtual disk ready: {disk_mb} MB dedicated to {username}")
+    return True, "ok"
+
+
+def _remove_virtual_disk(username, logs):
+    """Unmount and remove the virtual disk image for a user."""
+    try:
+        pw = pwd.getpwnam(username)
+        home = pw.pw_dir
+    except KeyError:
+        return
+
+    img_path = f"/home/{username}.img"
+
+    # Unmount
+    _run(f"umount {home} 2>/dev/null")
+    logs.append(f"  ↳ Unmounted {home}")
+
+    # Remove image
+    if os.path.exists(img_path):
+        os.remove(img_path)
+        logs.append(f"  ↳ Removed {img_path}")
+
+    # Remove from fstab
+    try:
+        with open('/etc/fstab', 'r') as f:
+            lines = f.readlines()
+        with open('/etc/fstab', 'w') as f:
+            for line in lines:
+                if img_path not in line:
+                    f.write(line)
+        logs.append("  ↳ Removed from /etc/fstab")
+    except Exception as e:
+        logs.append(f"  ⚠️ fstab cleanup error: {e}")
+
+
+def _setup_rootless_docker_via_script(username, logs):
+    """
+    Setup rootless Docker for a user by running the official installer.
+    This must be done AS the user in a proper login shell.
+    """
+    try:
+        pw = pwd.getpwnam(username)
+        uid = pw.pw_uid
+        home = pw.pw_dir
+    except KeyError as e:
+        return False, str(e)
+
+    # First, ensure the sysctl setting is applied (critical!)
+    _run("sysctl -w kernel.apparmor_restrict_unprivileged_userns=0")
+    _run("echo 'kernel.apparmor_restrict_unprivileged_userns=0' >> /etc/sysctl.conf")
+
+    # Ensure XDG_RUNTIME_DIR exists with correct permissions
+    runtime_dir = f"/run/user/{uid}"
+    os.makedirs(runtime_dir, exist_ok=True)
+    _run(f"chown {username}:{username} {runtime_dir}")
+    _run(f"chmod 700 {runtime_dir}")
+
+    logs.append(f"📝 Installing rootless Docker for {username}...")
+
+    # Create a simple installation script that runs as the user
+    install_cmd = f"""bash -c '
+export XDG_RUNTIME_DIR=/run/user/{uid}
+export PATH=$HOME/bin:$PATH
+mkdir -p $XDG_RUNTIME_DIR
+chmod 700 $XDG_RUNTIME_DIR
+
+# Install rootless Docker
+curl -fsSL https://get.docker.com/rootless | sh
+
+# Add environment variables to .bashrc
+echo "export PATH=$HOME/bin:\\$PATH" >> ~/.bashrc
+echo "export DOCKER_HOST=unix:///run/user/{uid}/docker.sock" >> ~/.bashrc
+echo "export XDG_RUNTIME_DIR=/run/user/{uid}" >> ~/.bashrc
+
+# Create systemd service
+mkdir -p ~/.config/systemd/user
+cat > ~/.config/systemd/user/docker.service << EOF
+[Unit]
+Description=Docker Rootless Daemon
+After=network.target
+
+[Service]
+Type=simple
+ExecStart=$HOME/bin/dockerd-rootless.sh
+Restart=always
+RestartSec=10
+Environment=PATH=$HOME/bin:/usr/local/bin:/usr/bin:/bin
+Environment=XDG_RUNTIME_DIR=/run/user/{uid}
+
+[Install]
+WantedBy=default.target
+EOF
+
+# Enable and start the service
+systemctl --user daemon-reload
+systemctl --user enable docker.service
+systemctl --user start docker.service
+
+# Wait for socket
+sleep 5
+'"""
+
+    try:
+        # Run the installation as the user
+        result = subprocess.run(
+            ['su', '-', username, '-c', install_cmd],
+            capture_output=True,
+            text=True,
+            timeout=300
+        )
+
+        # Log output
+        for line in result.stdout.split('\n'):
+            if line.strip():
+                logs.append(line.strip())
+        if result.stderr:
+            for line in result.stderr.split('\n')[-5:]:
+                if line.strip():
+                    logs.append(f"  stderr: {line.strip()}")
+
+        # Check if socket exists
+        sock = f"/run/user/{uid}/docker.sock"
+        if os.path.exists(sock):
+            logs.append(f"✅ Rootless Docker ready for {username}")
+            return True, "ok"
+        else:
+            logs.append(f"⚠️ Socket not found at {sock}")
+            return True, "socket_pending"
+
+    except subprocess.TimeoutExpired:
+        logs.append("⚠️ Setup timed out after 300s")
+        return False, "timeout"
+    except Exception as e:
+        logs.append(f"⚠️ Setup failed: {e}")
+        return False, str(e)
+
+
+def delete_user(username, remove_home=False):
+    """Remove a user. Returns (success, message)."""
+    logs = []
+
+    try:
+        pwd.getpwnam(username)
+    except KeyError:
+        return False, f"User '{username}' does not exist"
+
+    # Stop their docker service first
+    try:
+        pw = pwd.getpwnam(username)
+        _run(
+            f"XDG_RUNTIME_DIR=/run/user/{pw.pw_uid} "
+            f"su --login {username} --command 'systemctl --user stop docker-rootless.service 2>/dev/null' "
+            f"2>/dev/null"
+        )
+    except Exception:
+        pass
+
+    _run(f"loginctl disable-linger {username} 2>/dev/null")
+
+    # Clean up virtual disk BEFORE userdel (userdel might complain if home is busy)
+    _remove_virtual_disk(username, logs)
+
+    flag = '-r' if remove_home else ''
+    out, err = _run(f"userdel {flag} {username}")
+    if err and 'does not exist' not in err and 'mail spool' not in err:
+        return False, f"userdel error: {err}"
+
+    msg = f"✅ User {username} deleted" + (" (home removed)" if remove_home else "")
+    logs.append(msg)
+    return True, '\n'.join(logs)
+
+
+def get_user_disk_usage(username):
+    try:
+        pw = pwd.getpwnam(username)
+    except KeyError:
+        return {}
+    total_out, _ = _run(f"du -sh {pw.pw_dir} 2>/dev/null | cut -f1")
+
+    # Also check if there's a virtual disk and its capacity
+    img_path = f"/home/{username}.img"
+    vdisk_info = {}
+    if os.path.exists(img_path):
+        # Get mounted filesystem usage
+        df_out, _ = _run(f"df -h {pw.pw_dir} 2>/dev/null | tail -1")
+        if df_out:
+            parts = df_out.split()
+            if len(parts) >= 4:
+                vdisk_info = {
+                    'size':      parts[1],
+                    'used':      parts[2],
+                    'available': parts[3],
+                    'use_pct':   parts[4] if len(parts) > 4 else '?',
+                }
+
+    return {
+        'home':  pw.pw_dir,
+        'total': total_out or 'N/A',
+        'vdisk': vdisk_info,
+    }
diff --git a/platform/restore-myapps.sh b/platform/restore-myapps.sh
new file mode 100755
index 0000000..367adfe
--- /dev/null
+++ b/platform/restore-myapps.sh
@@ -0,0 +1,283 @@
+#!/bin/bash
+# =============================================
+# restore-myapps.sh — Complete Restore Script
+# =============================================
+
+set -uo pipefail
+
+# --------------------------------------------------
+# Parse arguments
+# --------------------------------------------------
+REMOTE_MODE=false
+REMOTE_IP=""
+REMOTE_USER="root"
+SSH_KEY=""
+USE_PASSWORD=false
+SSH_PASS=""
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --remote)
+            REMOTE_MODE=true
+            REMOTE_IP="$2"
+            REMOTE_USER="${3:-root}"
+            shift 3
+            ;;
+        --key)
+            SSH_KEY="$2"
+            shift 2
+            ;;
+        --password)
+            USE_PASSWORD=true
+            shift
+            ;;
+        *)
+            shift
+            ;;
+    esac
+done
+
+# --------------------------------------------------
+# If remote mode
+# --------------------------------------------------
+if [ "$REMOTE_MODE" = true ]; then
+    if [ -z "$REMOTE_IP" ]; then
+        echo "❌ --remote requires an IP address."
+        exit 1
+    fi
+
+    SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+    REMOTE_DEST="/tmp/restore-session-$(date +%s)"
+
+    SSH_OPTS="-o StrictHostKeyChecking=no -o ConnectTimeout=15"
+    if [ -n "$SSH_KEY" ]; then
+        SSH_OPTS="$SSH_OPTS -i $SSH_KEY"
+    fi
+
+    if [ "$USE_PASSWORD" = true ]; then
+        if ! command -v sshpass &>/dev/null; then
+            apt install sshpass -y
+        fi
+        read -s -p "SSH password for ${REMOTE_USER}@${REMOTE_IP}: " SSH_PASS
+        echo ""
+        SSH_CMD="sshpass -p '$SSH_PASS' ssh $SSH_OPTS ${REMOTE_USER}@${REMOTE_IP}"
+        SCP_CMD="sshpass -p '$SSH_PASS' scp $SSH_OPTS"
+    else
+        SSH_CMD="ssh $SSH_OPTS ${REMOTE_USER}@${REMOTE_IP}"
+        SCP_CMD="scp $SSH_OPTS"
+    fi
+
+    echo "========================================="
+    echo "📡 REMOTE RESTORE to ${REMOTE_USER}@${REMOTE_IP}"
+    echo "========================================="
+
+    $SSH_CMD "mkdir -p $REMOTE_DEST"
+    $SCP_CMD -r "$SCRIPT_DIR/." "${REMOTE_USER}@${REMOTE_IP}:${REMOTE_DEST}/"
+    $SSH_CMD "chmod +x $REMOTE_DEST/restore-myapps.sh && cd $REMOTE_DEST && bash restore-myapps.sh"
+    $SSH_CMD "rm -rf $REMOTE_DEST"
+
+    echo "✅ Remote restore complete"
+    exit 0
+fi
+
+# ===================================================
+# LOCAL RESTORE
+# ===================================================
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+cd "$SCRIPT_DIR"
+
+VM_IP=$(ip -4 addr show | grep -oP '(?<=inet\s)\d+(\.\d+){3}' | grep -v 127.0.0.1 | head -1)
+
+echo "========================================="
+echo "🔄 FULL RESTORE — LOCAL MODE"
+echo "   Machine IP: $VM_IP"
+echo "   Backup dir: $SCRIPT_DIR"
+echo "========================================="
+
+# --------------------------------------------------
+# STEP 1: Restore Volumes
+# --------------------------------------------------
+echo ""
+echo "📦 STEP 1 — Restoring Volumes"
+echo "========================================="
+
+if [ -d "$SCRIPT_DIR/volumes" ]; then
+    cd "$SCRIPT_DIR/volumes"
+    for backup in *.tar.gz; do
+        [ -f "$backup" ] || continue
+        volume=$(basename "$backup" .tar.gz)
+        echo -n "   📁 Restoring $volume ... "
+        docker volume create "$volume" &>/dev/null || true
+        docker run --rm \
+            -v "${volume}:/target" \
+            -v "$(pwd):/backup" \
+            alpine \
+            sh -c "cd /target && tar xzf /backup/$backup" \
+        && echo "✅" || echo "⚠️ FAILED"
+    done
+    cd "$SCRIPT_DIR"
+fi
+
+# --------------------------------------------------
+# STEP 2: Start Containers
+# --------------------------------------------------
+echo ""
+echo "🚀 STEP 2 — Starting Containers"
+echo "========================================="
+
+declare -A APP_DIRS=(
+    ["Frappe"]="frappe-setup"
+    ["Odoo"]="odoo-clean"
+    ["Nextcloud"]="nextcloud-setup"
+    ["Mautic"]="mautic-setup"
+    ["n8n"]="n8n-setup"
+)
+
+if [ -d "$SCRIPT_DIR/compose-files" ]; then
+    cd "$SCRIPT_DIR/compose-files"
+    for app in Frappe Odoo Nextcloud Mautic n8n; do
+        dir="${APP_DIRS[$app]}"
+        if [ -d "$dir" ]; then
+            echo "   🚀 Starting $app..."
+            cd "$dir"
+            docker-compose up -d 2>&1 | tail -3
+            cd ..
+        fi
+    done
+    cd "$SCRIPT_DIR"
+fi
+
+echo ""
+echo "⏳ Waiting 60s for containers to initialize..."
+sleep 60
+
+# --------------------------------------------------
+# STEP 3: Post-Restore Fixes
+# --------------------------------------------------
+echo ""
+echo "🔧 STEP 3 — Applying Post-Restore Fixes"
+echo "========================================="
+
+# ---- NEXTCLOUD ----
+echo ""
+echo "📌 Nextcloud — Trusted domains..."
+if docker ps | grep -q nextcloud-app; then
+    docker exec nextcloud-app php /var/www/html/occ config:system:delete trusted_domains 1 2>/dev/null || true
+    docker exec nextcloud-app php /var/www/html/occ config:system:delete trusted_domains 2 2>/dev/null || true
+    docker exec nextcloud-app php /var/www/html/occ config:system:set trusted_domains 0 --value="localhost"
+    docker exec nextcloud-app php /var/www/html/occ config:system:set trusted_domains 1 --value="$VM_IP"
+    docker exec nextcloud-app php /var/www/html/occ config:system:set trusted_domains 2 --value="${VM_IP}:8082"
+    docker exec nextcloud-app php /var/www/html/occ config:system:set trusted_domains 3 --value="localhost:8082"
+    docker restart nextcloud-app
+    echo "   ✅ Nextcloud fixed"
+fi
+
+# ---- MAUTIC ----
+echo ""
+echo "📌 Mautic — Config + admin password..."
+if docker ps | grep -q mautic-app; then
+    # Create config file
+    cat > /tmp/local.php << EOF
+<?php
+\$parameters = array(
+    'db_driver' => 'pdo_mysql',
+    'db_host' => 'mautic-mariadb',
+    'db_port' => '3306',
+    'db_name' => 'mautic',
+    'db_user' => 'mautic',
+    'db_password' => 'mautic123',
+    'site_url' => 'http://${VM_IP}:8081'
+);
+EOF
+    docker cp /tmp/local.php mautic-app:/var/www/html/config/local.php 2>/dev/null
+    docker exec mautic-app touch /var/www/html/var/.installed 2>/dev/null
+    docker exec mautic-app chown -R www-data:www-data /var/www/html/var 2>/dev/null
+    docker exec mautic-app chown -R www-data:www-data /var/www/html/config 2>/dev/null
+    docker restart mautic-app
+    sleep 10
+    HASH=$(docker exec mautic-app php -r "echo password_hash('Admin!Password123', PASSWORD_BCRYPT);" 2>/dev/null)
+    if [ ! -z "$HASH" ]; then
+        docker exec mautic-mariadb mysql -uroot -pmautic_root_password -e "USE mautic; UPDATE users SET password = '$HASH' WHERE username = 'admin';" 2>/dev/null
+        echo "   ✅ Admin password reset to: Admin!Password123"
+    fi
+    docker restart mautic-app
+    echo "   ✅ Mautic fixed → http://${VM_IP}:8081 (admin/Admin!Password123)"
+else
+    echo "   ⚠️ mautic-app not running"
+fi
+
+# ---- ODOO ----
+echo ""
+echo "📌 Odoo — Assets + DB user..."
+if docker ps | grep -q odoo-clean-db-1; then
+    docker exec odoo-clean-db-1 psql -U odoo -d odoo -c "DELETE FROM ir_attachment WHERE url LIKE '/web/assets/%';" 2>/dev/null
+    docker exec odoo-clean-db-1 psql -U odoo -c "ALTER USER odoo WITH PASSWORD 'odoo';" 2>/dev/null
+    docker exec odoo-clean-odoo-1 bash -c "grep -q 'filestore_check_missing' /etc/odoo/odoo.conf || echo 'filestore_check_missing = False' >> /etc/odoo/odoo.conf" 2>/dev/null
+    docker restart odoo-clean-odoo-1
+    echo "   ✅ Odoo fixed → http://${VM_IP}:8069/web"
+fi
+
+# ---- FRAPPE ----
+echo ""
+echo "📌 Frappe — Full fix..."
+if docker ps | grep -q frappe-erpnext && docker ps | grep -q frappe-mariadb; then
+    DB_NAME=$(docker exec frappe-erpnext cat /home/frappe/frappe-bench/sites/erpnext.navitrends.ovh/site_config.json 2>/dev/null | grep -o '"db_name": *"[^"]*"' | cut -d'"' -f4)
+    DB_PASS=$(docker exec frappe-erpnext cat /home/frappe/frappe-bench/sites/erpnext.navitrends.ovh/site_config.json 2>/dev/null | grep -o '"db_password": *"[^"]*"' | cut -d'"' -f4)
+    
+    if [ -n "$DB_NAME" ] && [ -n "$DB_PASS" ]; then
+        echo "   DB: $DB_NAME"
+        docker exec frappe-mariadb mysql -uroot -p123 -e "
+            GRANT ALL PRIVILEGES ON *.* TO '${DB_NAME}'@'%' IDENTIFIED BY '${DB_PASS}' WITH GRANT OPTION;
+            GRANT ALL PRIVILEGES ON *.* TO '${DB_NAME}'@'172.%' IDENTIFIED BY '${DB_PASS}' WITH GRANT OPTION;
+            GRANT ALL PRIVILEGES ON *.* TO '${DB_NAME}'@'localhost' IDENTIFIED BY '${DB_PASS}' WITH GRANT OPTION;
+            FLUSH PRIVILEGES;
+        " 2>/dev/null && echo "   ✅ DB permissions fixed"
+        
+        docker exec frappe-erpnext bash -c "
+            cd /home/frappe/frappe-bench
+            if [ ! -d 'apps/hrms' ]; then
+                bench get-app --branch version-15 https://github.com/frappe/hrms
+            fi
+            bench --site erpnext.navitrends.ovh install-app hrms
+        " 2>/dev/null && echo "   ✅ HRMS installed"
+        
+        docker exec frappe-erpnext bash -c "
+            cd /home/frappe/frappe-bench
+            bench --site erpnext.navitrends.ovh set-config redis_cache 'redis://frappe-redis:6379'
+            bench --site erpnext.navitrends.ovh set-config redis_queue 'redis://frappe-redis:6379'
+            bench --site erpnext.navitrends.ovh set-config enable_scheduler 1
+            bench --site erpnext.navitrends.ovh set-config site_url 'http://${VM_IP}:8080'
+            bench --site erpnext.navitrends.ovh migrate
+            bench --site erpnext.navitrends.ovh clear-cache
+            bench use erpnext.navitrends.ovh
+        " 2>/dev/null && echo "   ✅ Frappe configured"
+        
+        # Start bench serve in background inside container
+        docker exec -d frappe-erpnext bash -c "cd /home/frappe/frappe-bench && nohup bench serve --port 8000 > /tmp/bench.log 2>&1 &"
+        docker restart frappe-erpnext
+        echo "   ✅ Frappe fixed → http://${VM_IP}:8080"
+    else
+        echo "   ⚠️ Could not get Frappe credentials"
+    fi
+fi
+
+# ---- N8N ----
+echo ""
+echo "📌 n8n — Network check..."
+docker network inspect integration-network &>/dev/null || docker network create integration-network
+echo "   ✅ n8n → http://${VM_IP}:5678"
+
+# --------------------------------------------------
+# Summary
+# --------------------------------------------------
+echo ""
+echo "========================================="
+echo "✅ RESTORE COMPLETE"
+echo "========================================="
+echo "  Nextcloud → http://${VM_IP}:8082"
+echo "  Mautic    → http://${VM_IP}:8081 (admin/Admin!Password123)"
+echo "  Odoo      → http://${VM_IP}:8069/web"
+echo "  n8n       → http://${VM_IP}:5678"
+echo "  Frappe    → http://${VM_IP}:8080"
+echo "========================================="
diff --git a/platform/static/css/style.css b/platform/static/css/style.css
index 3f4a8fe..21cd990 100644
--- a/platform/static/css/style.css
+++ b/platform/static/css/style.css
@@ -1,645 +1,438 @@
-/* Modern Design System */
+/* ═══════════════════════════════════════════════════════════════
+   Navitrends Ops Platform
+   Fonts: Syne (display) + Geist Mono (data/code)
+   Theme: Dark (default) / Light — toggled via [data-theme="light"]
+═══════════════════════════════════════════════════════════════ */
+
+/* ── DARK THEME (default) ──────────────────────────────────── */
 :root {
-    --primary: #2563eb;
-    --primary-dark: #1d4ed8;
-    --primary-light: #3b82f6;
-    --primary-soft: #eff6ff;
-    --secondary: #64748b;
-    --accent: #f59e0b;
-    --success: #10b981;
-    --warning: #f59e0b;
-    --danger: #ef4444;
-    --dark: #0f172a;
-    --gray-dark: #334155;
-    --gray: #64748b;
-    --gray-light: #e2e8f0;
-    --light: #f8fafc;
-    --white: #ffffff;
-    --sidebar-width: 280px;
-    --radius-sm: 8px;
-    --radius-md: 12px;
-    --radius-lg: 16px;
+  --bg:        #0a0b0e;
+  --surface:   #111318;
+  --surface2:  #181c24;
+  --border:    #1e2330;
+  --border2:   #262d3d;
+
+  --text:      #e8ecf4;
+  --text2:     #8892a4;
+  --text3:     #4a5568;
+
+  --accent:    #3b82f6;
+  --accent2:   #60a5fa;
+  --green:     #22c55e;
+  --red:       #ef4444;
+  --yellow:    #f59e0b;
+  --purple:    #a78bfa;
+  --cyan:      #22d3ee;
+
+  --shadow:    0 1px 3px rgba(0,0,0,0.4), 0 4px 16px rgba(0,0,0,0.2);
+
+  --radius:    10px;
+  --radius-lg: 16px;
+  --font:      'Syne', sans-serif;
+  --mono:      'Geist Mono', monospace;
+  --trans:     0.18s ease;
 }
 
-* {
-    margin: 0;
-    padding: 0;
-    box-sizing: border-box;
+/* ── LIGHT THEME ───────────────────────────────────────────── */
+[data-theme="light"] {
+  --bg:       #f0f2f7;
+  --surface:  #ffffff;
+  --surface2: #f5f7fb;
+  --border:   #dde1ed;
+  --border2:  #c8cfe0;
+
+  --text:     #0f1117;
+  --text2:    #4a5578;
+  --text3:    #9aa3b8;
+
+  --accent:   #2563eb;
+  --accent2:  #3b82f6;
+  --green:    #16a34a;
+  --red:      #dc2626;
+  --yellow:   #d97706;
+  --purple:   #7c3aed;
+  --cyan:     #0891b2;
+
+  --shadow:   0 1px 3px rgba(0,0,0,0.08), 0 4px 16px rgba(0,0,0,0.06);
 }
 
-body {
-    font-family: 'Inter', -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
-    background: #f1f5f9;
-    color: var(--dark);
-    line-height: 1.5;
+/* ── RESET ─────────────────────────────────────────────────── */
+*, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
+
+html, body {
+  height: 100%;
+  background: var(--bg);
+  color: var(--text);
+  font-family: var(--font);
+  font-size: 14px;
+  line-height: 1.6;
+  -webkit-font-smoothing: antialiased;
+  transition: background 0.3s, color 0.3s;
 }
 
-.app {
-    display: flex;
-    min-height: 100vh;
-}
+::-webkit-scrollbar { width: 4px; height: 4px; }
+::-webkit-scrollbar-track { background: transparent; }
+::-webkit-scrollbar-thumb { background: var(--border2); border-radius: 4px; }
 
-/* Sidebar */
+/* ── LAYOUT ────────────────────────────────────────────────── */
+.layout { display: flex; height: 100vh; overflow: hidden; }
+
+/* ── SIDEBAR ───────────────────────────────────────────────── */
 .sidebar {
-    width: var(--sidebar-width);
-    background: var(--white);
-    position: fixed;
-    height: 100vh;
-    overflow-y: auto;
-    box-shadow: 0 1px 3px rgba(0,0,0,0.1);
-    border-right: 1px solid var(--gray-light);
-    z-index: 100;
+  width: 220px; min-width: 220px;
+  background: var(--surface);
+  border-right: 1px solid var(--border);
+  display: flex; flex-direction: column;
+  padding: 20px 12px;
+  transition: background 0.3s, border-color 0.3s;
 }
 
-.sidebar-header {
-    padding: 32px 24px;
-    border-bottom: 1px solid var(--gray-light);
-    margin-bottom: 24px;
+.sidebar-brand {
+  display: flex; align-items: center; gap: 12px;
+  padding: 0 8px 24px;
+  border-bottom: 1px solid var(--border);
+  margin-bottom: 20px;
 }
-
-.sidebar-header h2 {
-    font-size: 22px;
-    font-weight: 700;
-    background: linear-gradient(135deg, var(--primary) 0%, var(--primary-dark) 100%);
-    -webkit-background-clip: text;
-    background-clip: text;
-    color: transparent;
-    margin-bottom: 6px;
+.brand-mark {
+  width: 36px; height: 36px; background: var(--accent);
+  border-radius: 8px;
+  display: flex; align-items: center; justify-content: center;
+  font-family: var(--mono); font-weight: 500; font-size: 12px; color: #fff;
+  flex-shrink: 0;
 }
+.brand-name { font-size: 15px; font-weight: 700; letter-spacing: 0.02em; }
+.brand-sub  { font-size: 10px; color: var(--text3); font-family: var(--mono); letter-spacing: 0.08em; }
 
-.sidebar-header p {
-    font-size: 13px;
-    color: var(--gray);
-    font-weight: 500;
+.nav { flex: 1; display: flex; flex-direction: column; gap: 2px; }
+.nav-section-label {
+  font-size: 9px; letter-spacing: 0.12em; color: var(--text3);
+  font-family: var(--mono); padding: 0 8px;
+  margin-bottom: 6px; margin-top: 4px;
 }
-
-.nav-menu {
-    padding: 0 16px;
-}
-
 .nav-item {
-    padding: 12px 16px;
-    margin: 4px 0;
-    border-radius: var(--radius-md);
-    cursor: pointer;
-    transition: all 0.2s;
-    display: flex;
-    align-items: center;
-    gap: 12px;
-    color: var(--gray-dark);
-    font-weight: 500;
-    font-size: 14px;
+  display: flex; align-items: center; gap: 10px;
+  padding: 9px 12px; border-radius: var(--radius);
+  color: var(--text2); text-decoration: none;
+  font-size: 13px; font-weight: 500; cursor: pointer;
+  transition: background var(--trans), color var(--trans);
+}
+.nav-item:hover  { background: var(--surface2); color: var(--text); }
+.nav-item.active { background: var(--accent); color: #fff; }
+.nav-item i      { width: 16px; text-align: center; font-size: 13px; }
+.nav-badge {
+  margin-left: auto; font-family: var(--mono); font-size: 10px;
+  background: var(--border2); color: var(--text2);
+  padding: 2px 6px; border-radius: 20px;
+}
+.nav-item.active .nav-badge { background: rgba(255,255,255,0.25); color: #fff; }
+
+.sidebar-footer {
+  display: flex; align-items: center; gap: 8px;
+  padding-top: 16px; border-top: 1px solid var(--border); margin-top: auto;
+}
+.server-pill {
+  flex: 1; display: flex; align-items: center; gap: 7px;
+  background: var(--surface2); border-radius: 20px;
+  padding: 6px 10px; font-family: var(--mono);
+  font-size: 11px; color: var(--text2); overflow: hidden;
+}
+.pulse-dot {
+  width: 7px; height: 7px; border-radius: 50%;
+  background: var(--text3); flex-shrink: 0; transition: background 0.3s;
+}
+.pulse-dot.online  { background: var(--green); animation: pulse 2s infinite; }
+.pulse-dot.offline { background: var(--red); }
+@keyframes pulse {
+  0%,100% { box-shadow: 0 0 0 0 rgba(34,197,94,0.4); }
+  50%      { box-shadow: 0 0 0 4px rgba(34,197,94,0); }
 }
 
-.nav-item:hover {
-    background: var(--primary-soft);
-    color: var(--primary);
+.logout-btn {
+  width: 32px; height: 32px;
+  display: flex; align-items: center; justify-content: center;
+  border-radius: 8px; color: var(--text3); text-decoration: none;
+  transition: background var(--trans), color var(--trans);
+}
+.logout-btn:hover { background: var(--red); color: #fff; }
+
+/* ── THEME TOGGLE BUTTON ───────────────────────────────────── */
+.theme-toggle {
+  width: 32px; height: 32px;
+  display: flex; align-items: center; justify-content: center;
+  border-radius: 8px; background: var(--surface2);
+  border: 1px solid var(--border); color: var(--text2);
+  cursor: pointer; font-size: 14px;
+  transition: background var(--trans), color var(--trans), border-color var(--trans);
+}
+.theme-toggle:hover { background: var(--border2); color: var(--text); }
+
+/* ── MAIN ──────────────────────────────────────────────────── */
+.main { flex: 1; display: flex; flex-direction: column; overflow: hidden; }
+
+.topbar {
+  display: flex; align-items: center; justify-content: space-between;
+  padding: 18px 28px; border-bottom: 1px solid var(--border);
+  background: var(--surface); flex-shrink: 0;
+  transition: background 0.3s, border-color 0.3s;
+}
+.topbar-left  { display: flex; align-items: baseline; gap: 12px; }
+.page-title   { font-size: 20px; font-weight: 700; }
+.page-subtitle { font-family: var(--mono); font-size: 11px; color: var(--text3); }
+.topbar-right { display: flex; align-items: center; gap: 10px; }
+
+.icon-btn {
+  width: 34px; height: 34px; background: var(--surface2);
+  border: 1px solid var(--border); border-radius: 8px;
+  color: var(--text2); cursor: pointer;
+  display: flex; align-items: center; justify-content: center;
+  transition: background var(--trans), color var(--trans); font-size: 13px;
+}
+.icon-btn:hover { background: var(--border2); color: var(--text); }
+.icon-btn.spinning i { animation: spin 0.8s linear infinite; }
+@keyframes spin { to { transform: rotate(360deg); } }
+
+.uptime-chip {
+  font-family: var(--mono); font-size: 11px; color: var(--text3);
+  background: var(--surface2); border: 1px solid var(--border);
+  padding: 5px 12px; border-radius: 20px;
 }
 
-.nav-item.active {
-    background: var(--primary-soft);
-    color: var(--primary);
-    font-weight: 600;
+.content {
+  flex: 1; overflow-y: auto; padding: 24px 28px;
+  display: flex; flex-direction: column; gap: 20px;
 }
 
-.nav-icon {
-    width: 20px;
-    font-size: 16px;
-    text-align: center;
+/* ── PAGES ─────────────────────────────────────────────────── */
+.page { display: none; flex-direction: column; gap: 20px; }
+.page.active { display: flex; animation: fadeIn 0.2s ease; }
+@keyframes fadeIn {
+  from { opacity: 0; transform: translateY(5px); }
+  to   { opacity: 1; transform: translateY(0); }
 }
 
-/* Main Content */
-.main-content {
-    flex: 1;
-    margin-left: var(--sidebar-width);
-    padding: 32px 40px;
-}
-
-/* Top Bar */
-.top-bar {
-    background: var(--white);
-    padding: 20px 28px;
-    border-radius: var(--radius-lg);
-    margin-bottom: 28px;
-    box-shadow: 0 1px 2px rgba(0,0,0,0.05);
-    border: 1px solid var(--gray-light);
-    display: flex;
-    justify-content: space-between;
-    align-items: center;
-}
-
-.top-bar h3 {
-    font-size: 20px;
-    font-weight: 600;
-    color: var(--dark);
-}
-
-.server-status {
-    display: flex;
-    align-items: center;
-    gap: 20px;
-}
-
-.status-indicator {
-    display: flex;
-    align-items: center;
-    gap: 8px;
-    font-size: 13px;
-    font-weight: 500;
-    color: var(--gray);
-}
-
-.status-dot {
-    width: 8px;
-    height: 8px;
-    border-radius: 50%;
-}
-
-.status-dot.online {
-    background: var(--success);
-    box-shadow: 0 0 0 2px rgba(16, 185, 129, 0.2);
-}
-
-.status-dot.offline {
-    background: var(--danger);
-    box-shadow: 0 0 0 2px rgba(239, 68, 68, 0.2);
-}
-
-/* Buttons */
-.btn {
-    padding: 8px 18px;
-    border: none;
-    border-radius: var(--radius-md);
-    font-size: 13px;
-    font-weight: 600;
-    cursor: pointer;
-    transition: all 0.2s;
-    display: inline-flex;
-    align-items: center;
-    gap: 8px;
-}
-
-.btn-primary {
-    background: var(--primary);
-    color: white;
-}
-
-.btn-primary:hover {
-    background: var(--primary-dark);
-    transform: translateY(-1px);
-}
-
-.btn-danger {
-    background: var(--danger);
-    color: white;
-}
-
-.btn-danger:hover {
-    background: #dc2626;
-    transform: translateY(-1px);
-}
-
-.btn-secondary {
-    background: var(--gray-light);
-    color: var(--gray-dark);
-    border: 1px solid transparent;
-}
-
-.btn-secondary:hover {
-    background: var(--white);
-    border-color: var(--gray-light);
-}
-
-/* Cards */
+/* ── CARDS ─────────────────────────────────────────────────── */
 .card {
-    background: var(--white);
-    border-radius: var(--radius-lg);
-    padding: 24px 28px;
-    margin-bottom: 24px;
-    box-shadow: 0 1px 2px rgba(0,0,0,0.05);
-    border: 1px solid var(--gray-light);
-    transition: all 0.2s;
+  background: var(--surface); border: 1px solid var(--border);
+  border-radius: var(--radius-lg); padding: 20px;
+  box-shadow: var(--shadow);
+  transition: background 0.3s, border-color 0.3s;
 }
-
-.card:hover {
-    box-shadow: 0 4px 6px -1px rgba(0,0,0,0.1);
-}
-
 .card-header {
-    display: flex;
-    justify-content: space-between;
-    align-items: center;
-    margin-bottom: 20px;
-    padding-bottom: 16px;
-    border-bottom: 2px solid var(--gray-light);
+  display: flex; align-items: center; justify-content: space-between;
+  margin-bottom: 16px;
 }
-
 .card-title {
-    font-size: 18px;
-    font-weight: 600;
-    color: var(--dark);
-    display: flex;
-    align-items: center;
-    gap: 10px;
+  font-size: 13px; font-weight: 600; letter-spacing: 0.04em;
+  display: flex; align-items: center; gap: 8px; color: var(--text);
 }
+.card-title i { color: var(--accent2); font-size: 12px; }
+.card-meta { font-family: var(--mono); font-size: 11px; color: var(--text3); }
 
-/* Container Cards */
-.containers-grid {
-    display: grid;
-    grid-template-columns: repeat(auto-fill, minmax(320px, 1fr));
-    gap: 16px;
+/* ── SYSTEM METRICS ────────────────────────────────────────── */
+.metrics-row { display: grid; grid-template-columns: repeat(auto-fit, minmax(180px, 1fr)); gap: 14px; }
+.metric-card {
+  background: var(--surface2); border: 1px solid var(--border);
+  border-radius: var(--radius); padding: 16px; position: relative; overflow: hidden;
+  transition: background 0.3s, border-color 0.3s;
 }
-
-.container-card {
-    background: var(--light);
-    border-radius: var(--radius-md);
-    padding: 16px 20px;
-    transition: all 0.2s;
-    border: 1px solid var(--gray-light);
+.metric-card::before {
+  content: ''; position: absolute; top: 0; left: 0; right: 0; height: 2px; background: var(--accent);
 }
+.metric-card.mem::before  { background: var(--purple); }
+.metric-card.disk::before { background: var(--cyan); }
+.metric-card.load::before { background: var(--yellow); }
 
-.container-card.running {
-    border-left: 4px solid var(--success);
-}
-
-.container-card.stopped {
-    border-left: 4px solid var(--danger);
-}
-
-.container-card:hover {
-    transform: translateY(-2px);
-    box-shadow: 0 4px 6px -1px rgba(0,0,0,0.1);
-    background: var(--white);
-}
-
-.container-name {
-    font-weight: 600;
-    font-size: 15px;
-    margin-bottom: 8px;
-    display: flex;
-    justify-content: space-between;
-    align-items: center;
-    gap: 12px;
-}
-
-.container-name span {
-    display: flex;
-    align-items: center;
-    gap: 8px;
-}
-
-.container-status {
-    font-size: 12px;
-    color: var(--gray);
-    margin-top: 6px;
-    display: flex;
-    align-items: center;
-    gap: 6px;
-}
-
-/* Badges */
-.badge {
-    padding: 4px 12px;
-    border-radius: 20px;
-    font-size: 11px;
-    font-weight: 600;
-}
-
-.badge-running {
-    background: rgba(16, 185, 129, 0.1);
-    color: var(--success);
-}
-
-.badge-stopped {
-    background: rgba(239, 68, 68, 0.1);
-    color: var(--danger);
-}
-
-/* Stats Grid */
-.stats-grid {
-    display: grid;
-    grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
-    gap: 16px;
+.metric-label { font-family: var(--mono); font-size: 10px; letter-spacing: 0.1em; color: var(--text3); margin-bottom: 8px; }
+.metric-value { font-family: var(--mono); font-size: 22px; font-weight: 500; color: var(--text); line-height: 1; margin-bottom: 10px; }
+.metric-value span { font-size: 12px; color: var(--text3); }
+
+.gauge-bar  { height: 3px; background: var(--border2); border-radius: 4px; overflow: hidden; }
+.gauge-fill {
+  height: 100%; border-radius: 4px; background: var(--accent);
+  transition: width 0.6s ease;
 }
+.metric-card.mem  .gauge-fill { background: var(--purple); }
+.metric-card.disk .gauge-fill { background: var(--cyan); }
+.metric-card.load .gauge-fill { background: var(--yellow); }
 
+/* ── STAT ROW ──────────────────────────────────────────────── */
+.stat-row { display: grid; grid-template-columns: repeat(auto-fit, minmax(130px, 1fr)); gap: 12px; }
 .stat-card {
-    text-align: center;
-    padding: 20px;
-    background: var(--light);
-    border-radius: var(--radius-md);
-    transition: all 0.2s;
-    border: 1px solid var(--gray-light);
+  background: var(--surface2); border: 1px solid var(--border);
+  border-radius: var(--radius); padding: 14px 16px; text-align: center;
+  transition: background 0.3s;
 }
+.stat-number { font-family: var(--mono); font-size: 28px; font-weight: 500; color: var(--accent2); line-height: 1; }
+.stat-label  { font-size: 11px; color: var(--text3); margin-top: 5px; letter-spacing: 0.04em; }
 
-.stat-card:hover {
-    background: var(--white);
-    transform: translateY(-2px);
-    box-shadow: 0 4px 6px -1px rgba(0,0,0,0.1);
+/* ── CONTAINERS TABLE ──────────────────────────────────────── */
+.ct-table { width: 100%; border-collapse: collapse; }
+.ct-table th {
+  font-family: var(--mono); font-size: 10px; letter-spacing: 0.1em;
+  color: var(--text3); padding: 6px 10px; text-align: left;
+  border-bottom: 1px solid var(--border);
 }
-
-.stat-number {
-    font-size: 32px;
-    font-weight: 700;
-    color: var(--primary);
-    margin-bottom: 8px;
+.ct-table td {
+  padding: 10px; border-bottom: 1px solid var(--border);
+  font-size: 13px; vertical-align: middle;
 }
+.ct-table tr:last-child td { border-bottom: none; }
+.ct-table tr:hover td { background: var(--surface2); }
 
-.stat-label {
-    font-size: 13px;
-    color: var(--gray);
-    font-weight: 500;
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    gap: 6px;
+.ct-name  { font-family: var(--mono); font-size: 13px; color: var(--text); font-weight: 500; }
+.ct-image { font-family: var(--mono); font-size: 11px; color: var(--text3); max-width: 200px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.ct-ports { font-family: var(--mono); font-size: 11px; color: var(--cyan); }
+.ct-owner { font-family: var(--mono); font-size: 11px; color: var(--purple); }
+
+/* ── BADGES ────────────────────────────────────────────────── */
+.badge {
+  display: inline-flex; align-items: center; gap: 5px;
+  padding: 3px 9px; border-radius: 20px;
+  font-family: var(--mono); font-size: 11px; font-weight: 500;
 }
+.badge-run  { background: rgba(34,197,94,0.12);  color: var(--green); }
+.badge-stop { background: rgba(239,68,68,0.12);  color: var(--red); }
+.badge-run::before  { content:''; width:5px; height:5px; background:var(--green); border-radius:50%; }
+.badge-stop::before { content:''; width:5px; height:5px; background:var(--red);   border-radius:50%; }
+[data-theme="light"] .badge-run  { background: rgba(22,163,74,0.1); }
+[data-theme="light"] .badge-stop { background: rgba(220,38,38,0.1); }
 
-/* Two Column */
-.two-column {
-    display: grid;
-    grid-template-columns: 1fr 1fr;
-    gap: 28px;
+/* ── INLINE STAT BARS ──────────────────────────────────────── */
+.stat-bar-wrap  { display: flex; align-items: center; gap: 6px; min-width: 90px; }
+.stat-bar-bg    { flex: 1; height: 4px; background: var(--border2); border-radius: 4px; overflow: hidden; }
+.stat-bar-fill  { height: 100%; border-radius: 4px; background: var(--accent); transition: width 0.5s ease; }
+.stat-bar-fill.warn { background: var(--yellow); }
+.stat-bar-fill.crit { background: var(--red); }
+.stat-pct       { font-family: var(--mono); font-size: 10px; color: var(--text3); min-width: 36px; }
+
+/* ── USERS GRID ────────────────────────────────────────────── */
+.users-grid { display: grid; grid-template-columns: repeat(auto-fill, minmax(260px, 1fr)); gap: 14px; }
+.user-card {
+  background: var(--surface2); border: 1px solid var(--border);
+  border-radius: var(--radius); padding: 16px; cursor: pointer;
+  transition: border-color var(--trans), background var(--trans), box-shadow var(--trans);
 }
-
-.two-column h3 {
-    font-size: 16px;
-    font-weight: 600;
-    margin-bottom: 12px;
-    color: var(--dark);
-    display: flex;
-    align-items: center;
-    gap: 8px;
+.user-card:hover { border-color: var(--accent2); box-shadow: 0 0 0 1px var(--accent2); }
+.user-card-top  { display: flex; align-items: center; gap: 12px; margin-bottom: 12px; }
+.user-avatar    {
+  width: 38px; height: 38px; border-radius: 50%; display: flex;
+  align-items: center; justify-content: center;
+  font-weight: 700; font-size: 14px; flex-shrink: 0; color: #fff;
 }
-
-.two-column p {
-    font-size: 13px;
-    color: var(--gray);
-    margin-bottom: 16px;
+.user-name  { font-weight: 600; font-size: 14px; }
+.user-uid   { font-family: var(--mono); font-size: 11px; color: var(--text3); }
+.user-tags  { display: flex; gap: 6px; flex-wrap: wrap; }
+.user-tag {
+  font-family: var(--mono); font-size: 10px;
+  padding: 2px 8px; border-radius: 20px;
+  background: var(--border2); color: var(--text2);
 }
+.user-tag.docker { background: rgba(59,130,246,0.15); color: var(--accent2); }
+.user-tag.linger { background: rgba(34,197,94,0.12);  color: var(--green); }
+[data-theme="light"] .user-tag.docker { background: rgba(37,99,235,0.1); }
+[data-theme="light"] .user-tag.linger { background: rgba(22,163,74,0.1); }
 
-/* Select */
-select {
-    padding: 10px 14px;
-    border: 1px solid var(--gray-light);
-    border-radius: var(--radius-md);
-    font-size: 13px;
-    font-weight: 500;
-    background: var(--white);
-    cursor: pointer;
-    width: 100%;
-    color: var(--dark);
-    margin-bottom: 16px;
-}
+.user-stats { display: flex; gap: 16px; margin-top: 10px; }
+.user-stat  { font-family: var(--mono); font-size: 11px; color: var(--text3); }
+.user-stat strong { color: var(--text); }
 
-select:hover {
-    border-color: var(--primary);
-}
-
-select:focus {
-    outline: none;
-    border-color: var(--primary);
-    box-shadow: 0 0 0 3px rgba(37, 99, 235, 0.1);
-}
-
-/* Backup List */
-.backup-list {
-    max-height: 320px;
-    overflow-y: auto;
-}
-
-.backup-item {
-    display: flex;
-    justify-content: space-between;
-    align-items: center;
-    padding: 12px 16px;
-    background: var(--light);
-    border-radius: var(--radius-md);
-    margin-bottom: 8px;
-    transition: all 0.2s;
-    border: 1px solid var(--gray-light);
-}
-
-.backup-item:hover {
-    background: var(--white);
-    border-color: var(--primary);
-    transform: translateX(4px);
-}
-
-.backup-date {
-    font-family: monospace;
-    font-size: 12px;
-    color: var(--dark);
-    font-weight: 500;
-    display: flex;
-    align-items: center;
-    gap: 8px;
-}
-
-.backup-size {
-    font-size: 11px;
-    color: var(--gray);
-    font-weight: 500;
-    background: var(--gray-light);
-    padding: 2px 8px;
-    border-radius: 20px;
-    display: flex;
-    align-items: center;
-    gap: 4px;
-}
-
-/* Restore Status */
-.restore-status {
-    margin-top: 24px;
-    padding: 14px 20px;
-    border-radius: var(--radius-md);
-    display: none;
-    font-size: 13px;
-    font-weight: 500;
-}
-
-.restore-status.success {
-    background: rgba(16, 185, 129, 0.08);
-    color: var(--success);
-    border-left: 3px solid var(--success);
-}
-
-.restore-status.error {
-    background: rgba(239, 68, 68, 0.08);
-    color: var(--danger);
-    border-left: 3px solid var(--danger);
-}
-
-.restore-status.warning {
-    background: rgba(245, 158, 11, 0.08);
-    color: var(--accent);
-    border-left: 3px solid var(--accent);
-}
-
-/* Footer */
-.footer {
-    text-align: center;
-    padding: 24px 0 0;
-    color: var(--gray);
-    font-size: 12px;
-    margin-top: 40px;
-    border-top: 1px solid var(--gray-light);
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    gap: 8px;
-}
-
-/* Scrollbar */
-::-webkit-scrollbar {
-    width: 8px;
-    height: 8px;
-}
-
-::-webkit-scrollbar-track {
-    background: var(--gray-light);
-    border-radius: 10px;
-}
-
-::-webkit-scrollbar-thumb {
-    background: var(--primary);
-    border-radius: 10px;
-}
-
-::-webkit-scrollbar-thumb:hover {
-    background: var(--primary-dark);
-}
-
-/* Responsive */
-@media (max-width: 768px) {
-    .sidebar {
-        transform: translateX(-100%);
-    }
-    .main-content {
-        margin-left: 0;
-        padding: 20px;
-    }
-    .two-column {
-        grid-template-columns: 1fr;
-    }
-    .containers-grid {
-        grid-template-columns: 1fr;
-    }
-    .top-bar {
-        flex-direction: column;
-        align-items: flex-start;
-        gap: 12px;
-    }
-}
-/* ─── Add these to your existing style.css ─────────────────────────────── */
-
-/* Restore form layout */
+/* ── RESTORE FORM ──────────────────────────────────────────── */
 .restore-form { display: flex; flex-direction: column; gap: 0; }
+.form-section { padding: 20px 0; border-bottom: 1px solid var(--border); }
+.form-section:last-child { border-bottom: none; }
+.form-section-title { font-size: 10px; font-family: var(--mono); letter-spacing: 0.12em; color: var(--text3); margin-bottom: 14px; }
 
-.form-section {
-    border-bottom: 1px solid var(--border, #e5e7eb);
-    padding: 20px 0;
-}
-.form-section-title {
-    font-size: 13px;
-    font-weight: 600;
-    letter-spacing: 0.07em;
-    text-transform: uppercase;
-    color: var(--gray, #6b7280);
-    margin-bottom: 14px;
-}
-
-/* Radio cards */
-.radio-group {
-    display: flex;
-    gap: 12px;
-    flex-wrap: wrap;
-}
-.radio-card {
-    cursor: pointer;
-    flex: 1;
-    min-width: 180px;
-}
-.radio-card input[type="radio"] { display: none; }
+.radio-group { display: flex; gap: 10px; flex-wrap: wrap; }
+.radio-card  { cursor: pointer; flex: 1; min-width: 180px; }
+.radio-card input { display: none; }
 .radio-body {
-    display: flex;
-    align-items: center;
-    gap: 12px;
-    padding: 14px 16px;
-    border: 2px solid var(--border, #e5e7eb);
-    border-radius: 12px;
-    background: var(--light, #f9fafb);
-    transition: border-color 0.15s, background 0.15s;
+  display: flex; align-items: center; gap: 10px;
+  padding: 12px 14px; border: 1px solid var(--border2);
+  border-radius: var(--radius); background: var(--surface2);
+  transition: border-color var(--trans), background var(--trans);
 }
-.radio-card input:checked + .radio-body {
-    border-color: var(--primary, #6366f1);
-    background: #eef2ff;
-}
-.radio-icon { font-size: 22px; }
-.radio-label { font-weight: 600; font-size: 14px; }
-.radio-desc  { font-size: 12px; color: var(--gray, #6b7280); }
-.radio-desc code { background: #e5e7eb; padding: 1px 5px; border-radius: 4px; font-size: 11px; }
+.radio-card input:checked + .radio-body { border-color: var(--accent); background: rgba(59,130,246,0.08); }
+[data-theme="light"] .radio-card input:checked + .radio-body { background: rgba(37,99,235,0.06); }
+.radio-label { font-size: 13px; font-weight: 600; }
+.radio-desc  { font-size: 11px; color: var(--text3); }
+.radio-desc code { background: var(--border2); padding: 1px 5px; border-radius: 4px; font-family: var(--mono); }
+.radio-icon  { font-size: 18px; }
+.radio-card.small .radio-body  { padding: 9px 12px; gap: 8px; }
+.radio-card.small .radio-label { font-size: 12px; }
 
-/* Small radio cards (auth method) */
-.radio-card.small .radio-body { padding: 10px 14px; gap: 8px; }
-.radio-card.small .radio-label { font-size: 13px; }
-
-/* Form controls */
-.form-group { margin-bottom: 14px; }
-.form-label {
-    display: block;
-    font-size: 13px;
-    font-weight: 500;
-    margin-bottom: 6px;
-    color: var(--dark, #111827);
-}
-.form-control {
-    width: 100%;
-    padding: 10px 14px;
-    border: 1px solid var(--border, #e5e7eb);
-    border-radius: 10px;
-    font-size: 14px;
-    background: #fff;
-    box-sizing: border-box;
-    transition: border-color 0.15s;
-}
-.form-control:focus {
-    outline: none;
-    border-color: var(--primary, #6366f1);
-}
-.form-row {
-    display: flex;
-    gap: 14px;
-}
+.form-row   { display: flex; gap: 12px; }
 .form-row .form-group { flex: 1; }
-
-/* Buttons */
-.btn-lg { padding: 14px 28px; font-size: 15px; font-weight: 600; }
-.btn-sm { padding: 5px 12px; font-size: 12px; }
-
-/* Log console */
-.log-console {
-    background: #0f172a;
-    border-radius: 10px;
-    padding: 16px;
-    font-family: 'Courier New', monospace;
-    font-size: 12.5px;
-    line-height: 1.6;
-    max-height: 420px;
-    overflow-y: auto;
-    color: #e2e8f0;
+.form-group { display: flex; flex-direction: column; gap: 6px; }
+.form-label { font-size: 11px; font-weight: 600; color: var(--text2); letter-spacing: 0.06em; }
+.form-input {
+  background: var(--surface2); border: 1px solid var(--border2);
+  border-radius: 8px; padding: 9px 12px; font-size: 13px;
+  font-family: var(--mono); color: var(--text); width: 100%;
+  transition: border-color var(--trans), background 0.3s;
 }
+.form-input:focus { outline: none; border-color: var(--accent); }
+.form-input[readonly] { opacity: 0.6; cursor: default; }
+.form-check { display: flex; align-items: center; gap: 8px; font-size: 13px; cursor: pointer; }
+.form-check input { accent-color: var(--accent); width: 14px; height: 14px; }
+
+/* ── BUTTONS ───────────────────────────────────────────────── */
+.btn {
+  display: inline-flex; align-items: center; gap: 7px;
+  padding: 9px 16px; border-radius: 8px;
+  font-size: 13px; font-weight: 600; font-family: var(--font);
+  cursor: pointer; border: none;
+  transition: opacity var(--trans), background var(--trans), filter var(--trans);
+}
+.btn:hover    { filter: brightness(1.1); }
+.btn:disabled { opacity: 0.4; cursor: not-allowed; filter: none; }
+.btn-primary { background: var(--accent); color: #fff; }
+.btn-danger  { background: var(--red);   color: #fff; }
+.btn-success { background: var(--green); color: #fff; }
+.btn-ghost   { background: var(--surface2); border: 1px solid var(--border2); color: var(--text2); }
+.btn-ghost:hover { background: var(--border2); color: var(--text); filter: none; }
+.btn-sm { padding: 5px 11px; font-size: 12px; }
+.btn-lg { padding: 12px 24px; font-size: 14px; }
+
+/* ── LOG CONSOLE ───────────────────────────────────────────── */
+.log-console {
+  background: #05060a; border: 1px solid var(--border);
+  border-radius: var(--radius); padding: 14px 16px;
+  font-family: var(--mono); font-size: 12px; line-height: 1.7;
+  max-height: 400px; overflow-y: auto; color: #8892a4;
+}
+[data-theme="light"] .log-console { background: #1a1f2e; border-color: #2d3555; }
 .log-line { white-space: pre-wrap; word-break: break-all; }
 
-/* Backup list items */
+/* ── BACKUP LIST ───────────────────────────────────────────── */
+.backup-list { display: flex; flex-direction: column; gap: 8px; }
 .backup-item {
-    display: flex;
-    align-items: center;
-    justify-content: space-between;
-    padding: 10px 14px;
-    border-radius: 8px;
-    margin-bottom: 8px;
-    background: var(--light, #f9fafb);
-    gap: 10px;
-    flex-wrap: wrap;
+  display: flex; align-items: center; justify-content: space-between;
+  padding: 9px 12px; border-radius: 8px;
+  background: var(--surface2); gap: 10px; flex-wrap: wrap;
+  border: 1px solid var(--border);
 }
-.backup-date { font-size: 13px; font-family: monospace; word-break: break-all; }
+.backup-name { font-family: var(--mono); font-size: 12px; color: var(--text2); }
+
+/* ── TWO COLUMN ────────────────────────────────────────────── */
+.two-col { display: grid; grid-template-columns: 1fr 1fr; gap: 16px; }
+@media (max-width: 768px) { .two-col { grid-template-columns: 1fr; } }
+
+/* ── FORM GRID ─────────────────────────────────────────────── */
+.form-grid { display: grid; grid-template-columns: 1fr 1fr; gap: 14px; }
+@media (max-width: 600px) { .form-grid { grid-template-columns: 1fr; } }
+
+/* ── SECTION HEADER ────────────────────────────────────────── */
+.section-header { display: flex; align-items: center; justify-content: space-between; margin-bottom: 14px; }
+.section-title  { font-size: 13px; font-weight: 600; color: var(--text2); font-family: var(--mono); letter-spacing: 0.06em; }
+
+/* ── ALERTS ────────────────────────────────────────────────── */
+.alert { padding: 10px 14px; border-radius: 8px; font-size: 13px; display: none; }
+.alert.show   { display: block; }
+.alert-success { background: rgba(34,197,94,0.1);  color: var(--green); border: 1px solid rgba(34,197,94,0.2); }
+.alert-error   { background: rgba(239,68,68,0.1);  color: var(--red);   border: 1px solid rgba(239,68,68,0.2); }
+[data-theme="light"] .alert-success { background: rgba(22,163,74,0.08); }
+[data-theme="light"] .alert-error   { background: rgba(220,38,38,0.08); }
+
+/* ── EMPTY STATE ───────────────────────────────────────────── */
+.empty-state { text-align: center; padding: 36px; color: var(--text3); font-size: 13px; }
+.empty-state i { font-size: 26px; display: block; margin-bottom: 10px; opacity: 0.35; }
diff --git a/platform/templates/base.html b/platform/templates/base.html
index d607dc8..ab088e6 100644
--- a/platform/templates/base.html
+++ b/platform/templates/base.html
@@ -1,67 +1,108 @@
 <!DOCTYPE html>
-<html lang="en">
+<html lang="en" data-theme="dark">
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Navitrends - Management Platform</title>
-    <link href="https://fonts.googleapis.com/css2?family=Inter:opsz,wght@14..32,400;14..32,500;14..32,600;14..32,700&display=swap" rel="stylesheet">
+    <title>Navitrends — Ops Platform</title>
+    <link rel="preconnect" href="https://fonts.googleapis.com">
+    <link href="https://fonts.googleapis.com/css2?family=Syne:wght@400;500;600;700;800&family=Geist+Mono:wght@300;400;500&display=swap" rel="stylesheet">
     <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.7.2/css/all.min.css">
     <link rel="stylesheet" href="{{ url_for('static', filename='css/style.css') }}">
 </head>
 <body>
-    <div class="app">
-        <div class="sidebar">
-            <div class="sidebar-header">
-                <h2>Navitrends</h2>
-                <p>Management Platform</p>
-            </div>
-            <div class="nav-menu">
-                <div class="nav-item active" data-page="dashboard">
-                    <i class="fas fa-chart-line nav-icon"></i>
-                    <span>Dashboard</span>
-                </div>
-                <div class="nav-item" data-page="restore">
-                    <i class="fas fa-rotate-right nav-icon"></i>
-                    <span>Restore Actions</span>
-                </div>
-                <div class="nav-item" data-page="backups">
-                    <i class="fas fa-database nav-icon"></i>
-                    <span>Backups</span>
-                </div>
-                <div class="nav-item" data-page="settings">
-                    <i class="fas fa-sliders-h nav-icon"></i>
-                    <span>Settings</span>
-                </div>
-            </div>
-        </div>
+    <div class="layout">
 
-        <div class="main-content">
-            <div class="top-bar">
-                <h3 id="page-title">Dashboard Overview</h3>
-                <div class="server-status">
-                    <div class="status-indicator">
-                        <span class="status-dot" id="server-status-dot"></span>
-                        <span id="server-status-text">Checking...</span>
-                    </div>
-                    <button class="btn btn-secondary" onclick="refreshStatus()">
-                        <i class="fas fa-sync-alt"></i> Refresh
+        <!-- ── SIDEBAR ── -->
+        <aside class="sidebar">
+            <div class="sidebar-brand">
+                <div class="brand-mark">NV</div>
+                <div>
+                    <div class="brand-name">Navitrends</div>
+                    <div class="brand-sub">OPS PLATFORM</div>
+                </div>
+            </div>
+
+            <nav class="nav">
+                <div class="nav-section-label">MONITOR</div>
+                <a class="nav-item active" data-page="dashboard" href="#">
+                    <i class="fas fa-gauge-high"></i><span>Dashboard</span>
+                </a>
+                <a class="nav-item" data-page="containers" href="#">
+                    <i class="fas fa-cubes"></i><span>All Containers</span>
+                    <span class="nav-badge" id="nav-badge-containers">—</span>
+                </a>
+
+                <div class="nav-section-label" style="margin-top:20px;">OPERATIONS</div>
+                <a class="nav-item" data-page="restore" href="#">
+                    <i class="fas fa-rotate-right"></i><span>Restore</span>
+                </a>
+                <a class="nav-item" data-page="backups" href="#">
+                    <i class="fas fa-database"></i><span>Backups</span>
+                </a>
+
+                <div class="nav-section-label" style="margin-top:20px;">ADMIN</div>
+                <a class="nav-item" data-page="users" href="#">
+                    <i class="fas fa-users-gear"></i><span>Users</span>
+                    <span class="nav-badge" id="nav-badge-users">—</span>
+                </a>
+                <a class="nav-item" data-page="settings" href="#">
+                    <i class="fas fa-sliders"></i><span>Settings</span>
+                </a>
+            </nav>
+
+            <div class="sidebar-footer">
+                <div class="server-pill" id="server-pill">
+                    <span class="pulse-dot" id="pulse-dot"></span>
+                    <span id="server-status-text">Checking…</span>
+                </div>
+                <!-- Theme toggle -->
+                <button class="theme-toggle" id="theme-toggle" title="Toggle light/dark mode" onclick="toggleTheme()">
+                    <i class="fas fa-moon" id="theme-icon"></i>
+                </button>
+                <a href="/logout" class="logout-btn" title="Logout"><i class="fas fa-right-from-bracket"></i></a>
+            </div>
+        </aside>
+
+        <!-- ── MAIN ── -->
+        <main class="main">
+            <header class="topbar">
+                <div class="topbar-left">
+                    <h1 class="page-title" id="page-title">Dashboard</h1>
+                    <span class="page-subtitle" id="page-subtitle">{{ main_server }}</span>
+                </div>
+                <div class="topbar-right">
+                    <button class="icon-btn" onclick="refreshAll()" title="Refresh">
+                        <i class="fas fa-sync-alt" id="refresh-icon"></i>
                     </button>
-                    <a href="/logout">
-                        <button class="btn btn-secondary">
-                            <i class="fas fa-sign-out-alt"></i> Logout
-                        </button>
-                    </a>
+                    <div class="uptime-chip" id="uptime-chip">—</div>
                 </div>
-            </div>
+            </header>
 
-            {% block content %}{% endblock %}
-
-            <div class="footer">
-                <i class="fas fa-shield-alt"></i> Navitrends Management Platform
+            <div class="content">
+                {% block content %}{% endblock %}
             </div>
-        </div>
+        </main>
     </div>
 
     <script src="{{ url_for('static', filename='js/main.js') }}"></script>
+    <script>
+    // ── Theme persistence ───────────────────────────────────────
+    (function() {
+        const saved = localStorage.getItem('nv-theme') || 'dark';
+        applyTheme(saved);
+    })();
+
+    function applyTheme(theme) {
+        document.documentElement.setAttribute('data-theme', theme);
+        const icon = document.getElementById('theme-icon');
+        if (icon) icon.className = theme === 'dark' ? 'fas fa-moon' : 'fas fa-sun';
+        localStorage.setItem('nv-theme', theme);
+    }
+
+    function toggleTheme() {
+        const current = document.documentElement.getAttribute('data-theme') || 'dark';
+        applyTheme(current === 'dark' ? 'light' : 'dark');
+    }
+    </script>
 </body>
 </html>
diff --git a/platform/templates/dashboard.html b/platform/templates/dashboard.html
index 5904cbb..cc9672e 100644
--- a/platform/templates/dashboard.html
+++ b/platform/templates/dashboard.html
@@ -1,466 +1,959 @@
 {% extends "base.html" %}
-
 {% block content %}
 
-<div id="dashboard-page" class="page">
-    <div class="card">
-        <div class="card-header">
-            <div class="card-title"><span>📦</span><span>Application Status</span></div>
-            <span style="color:var(--gray);" id="container-count">{{ containers|length }} containers</span>
-        </div>
-        <div class="containers-grid" id="containers-grid">
-            {% for container in containers %}
-            <div class="container-card {% if 'Up' in container.status %}running{% else %}stopped{% endif %}">
-                <div class="container-name">
-                    <span>{{ container.name }}</span>
-                    <span class="badge {% if 'Up' in container.status %}badge-running{% else %}badge-stopped{% endif %}">
-                        {% if 'Up' in container.status %}Running{% else %}Stopped{% endif %}
-                    </span>
-                </div>
-                <div class="container-status">{{ container.status }}</div>
-            </div>
-            {% endfor %}
-        </div>
-    </div>
+{# ═══════════════════════════════════════════════════════
+   DASHBOARD PAGE
+═══════════════════════════════════════════════════════ #}
+<div id="dashboard-page" class="page active">
 
-    <div class="card">
-        <div class="card-header">
-            <div class="card-title"><span>📈</span><span>Quick Stats</span></div>
-        </div>
-        <div class="stats-grid">
-            <div class="stat-card">
-                <div class="stat-number" id="stat-total">{{ containers|length }}</div>
-                <div class="stat-label">Total Containers</div>
-            </div>
-            <div class="stat-card">
-                <div class="stat-number" id="stat-running">{{ running_count }}</div>
-                <div class="stat-label">Running</div>
-            </div>
-            <div class="stat-card">
-                <div class="stat-number" id="stat-local">{{ backups|length }}</div>
-                <div class="stat-label">Local Backups</div>
-            </div>
-            <div class="stat-card">
-                <div class="stat-number" id="stat-vm">{{ vm_backups|length }}</div>
-                <div class="stat-label">VM Backups</div>
-            </div>
-        </div>
+  <!-- System Metrics -->
+  <div class="metrics-row">
+    <div class="metric-card cpu">
+      <div class="metric-label">CPU USAGE</div>
+      <div class="metric-value" id="m-cpu">{{ system.cpu_pct }}<span>%</span></div>
+      <div class="gauge-bar"><div class="gauge-fill" id="g-cpu" style="width:{{ system.cpu_pct }}%"></div></div>
     </div>
+    <div class="metric-card mem">
+      <div class="metric-label">MEMORY</div>
+      <div class="metric-value" id="m-mem" style="font-size:16px;">{{ system.memory }}</div>
+      <div class="gauge-bar"><div class="gauge-fill" id="g-mem" style="width:{{ system.mem_pct }}%"></div></div>
+    </div>
+    <div class="metric-card disk">
+      <div class="metric-label">DISK /</div>
+      <div class="metric-value" id="m-disk" style="font-size:16px;">{{ system.disk }}</div>
+      <div class="gauge-bar"><div class="gauge-fill" id="g-disk" style="width:{{ system.disk_pct }}%"></div></div>
+    </div>
+    <div class="metric-card load">
+      <div class="metric-label">LOAD AVG</div>
+      <div class="metric-value" id="m-load" style="font-size:16px;">{{ system.load }}</div>
+      <div class="gauge-bar"><div class="gauge-fill" id="g-load" style="width:10%"></div></div>
+    </div>
+  </div>
+
+  <!-- Quick Stats -->
+  <div class="card">
+    <div class="card-header">
+      <div class="card-title"><i class="fas fa-chart-line"></i> Overview</div>
+      <span class="card-meta" id="docker-version">Docker {{ system.docker_v }}</span>
+    </div>
+    <div class="stat-row">
+      <div class="stat-card">
+        <div class="stat-number" id="stat-total">{{ containers|length }}</div>
+        <div class="stat-label">App Containers</div>
+      </div>
+      <div class="stat-card">
+        <div class="stat-number" id="stat-running">{{ running_count }}</div>
+        <div class="stat-label">Running</div>
+      </div>
+      <div class="stat-card">
+        <div class="stat-number" id="stat-users">{{ users|length }}</div>
+        <div class="stat-label">Linux Users</div>
+      </div>
+      <div class="stat-card">
+        <div class="stat-number" id="stat-local-bk">{{ backups|length }}</div>
+        <div class="stat-label">Local Backups</div>
+      </div>
+      <div class="stat-card">
+        <div class="stat-number" id="stat-vm-bk">{{ vm_backups|length }}</div>
+        <div class="stat-label">VM Backups</div>
+      </div>
+    </div>
+  </div>
+
+  <!-- App Containers with Live Stats -->
+  <div class="card">
+    <div class="card-header">
+      <div class="card-title"><i class="fas fa-cubes"></i> App Containers</div>
+      <span class="card-meta">Auto-refresh every 15s</span>
+    </div>
+    <div style="overflow-x:auto;">
+      <table class="ct-table" id="app-containers-table">
+        <thead>
+          <tr>
+            <th>NAME</th>
+            <th>STATUS</th>
+            <th>CPU</th>
+            <th>MEMORY</th>
+            <th>NET I/O</th>
+            <th>DISK I/O</th>
+            <th>IMAGE</th>
+            <th>PORTS</th>
+          </tr>
+        </thead>
+        <tbody id="app-containers-body">
+          {% for c in containers %}
+          <tr>
+            <td class="ct-name">{{ c.name }}</td>
+            <td>
+              {% if 'Up' in c.status %}
+                <span class="badge badge-run">Running</span>
+              {% else %}
+                <span class="badge badge-stop">Stopped</span>
+              {% endif %}
+            </td>
+            <td><span class="stat-pct" data-ctr="{{ c.name }}" data-stat="cpu">—</span></td>
+            <td>
+              <div class="stat-bar-wrap">
+                <div class="stat-bar-bg">
+                  <div class="stat-bar-fill" data-ctr="{{ c.name }}" data-stat="mem_bar" style="width:0%"></div>
+                </div>
+                <span class="stat-pct" data-ctr="{{ c.name }}" data-stat="mem_pct">—</span>
+              </div>
+            </td>
+            <td><span class="stat-pct" data-ctr="{{ c.name }}" data-stat="net" style="color:var(--cyan)">—</span></td>
+            <td><span class="stat-pct" data-ctr="{{ c.name }}" data-stat="block" style="color:var(--yellow)">—</span></td>
+            <td class="ct-image">{{ c.image }}</td>
+            <td class="ct-ports">{{ c.ports or '—' }}</td>
+          </tr>
+          {% else %}
+          <tr><td colspan="8"><div class="empty-state"><i class="fas fa-inbox"></i>No containers found</div></td></tr>
+          {% endfor %}
+        </tbody>
+      </table>
+    </div>
+  </div>
 </div>
 
-<div id="restore-page" class="page" style="display:none;">
-    <div class="card">
-        <div class="card-header">
-            <div class="card-title"><span>🔄</span><span>Restore Configuration</span></div>
-        </div>
-
-        <div class="restore-form">
-
-            <div class="form-section">
-                <div class="form-section-title">Step 1 — Select Backup Source</div>
-                <div class="radio-group">
-                    <label class="radio-card">
-                        <input type="radio" name="backup_source" value="local" checked onchange="updateBackupList()">
-                        <div class="radio-body">
-                            <span class="radio-icon">🖥️</span>
-                            <div>
-                                <div class="radio-label">Main Server (local)</div>
-                                <div class="radio-desc">Backups in <code>/root/backups/</code></div>
-                            </div>
-                        </div>
-                    </label>
-                    <label class="radio-card">
-                        <input type="radio" name="backup_source" value="vm" onchange="updateBackupList()">
-                        <div class="radio-body">
-                            <span class="radio-icon">💾</span>
-                            <div>
-                                <div class="radio-label">VM Backup Server</div>
-                                <div class="radio-desc">Backups in <code>/backups/main-server/</code></div>
-                            </div>
-                        </div>
-                    </label>
-                </div>
-
-                <div class="form-group" style="margin-top:14px;">
-                    <label class="form-label">Select Backup File</label>
-                    <select id="backup-file-select" class="form-control">
-                        <optgroup label="Main Server Backups" id="local-options">
-                            {% for b in backups %}
-                            <option value="{{ b }}" data-source="local">{{ b }}</option>
-                            {% else %}
-                            <option disabled>No local backups found</option>
-                            {% endfor %}
-                        </optgroup>
-                        <optgroup label="VM Backups" id="vm-options" style="display:none;">
-                            {% for b in vm_backups %}
-                            <option value="{{ b }}" data-source="vm">{{ b }}</option>
-                            {% else %}
-                            <option disabled>No VM backups found</option>
-                            {% endfor %}
-                        </optgroup>
-                    </select>
-                </div>
-            </div>
-
-            <div class="form-section">
-                <div class="form-section-title">Step 2 — Select Restore Target</div>
-                <div class="radio-group">
-                    <label class="radio-card">
-                        <input type="radio" name="restore_target" value="local" checked onchange="toggleRemoteFields()">
-                        <div class="radio-body">
-                            <span class="radio-icon">🎯</span>
-                            <div>
-                                <div class="radio-label">This Server ({{ main_server }})</div>
-                                <div class="radio-desc">Restore directly on the main server</div>
-                            </div>
-                        </div>
-                    </label>
-                    <label class="radio-card">
-                        <input type="radio" name="restore_target" value="remote" onchange="toggleRemoteFields()">
-                        <div class="radio-body">
-                            <span class="radio-icon">📡</span>
-                            <div>
-                                <div class="radio-label">Remote Machine (via SSH)</div>
-                                <div class="radio-desc">Restore on another server or the VM</div>
-                            </div>
-                        </div>
-                    </label>
-                </div>
-
-                <div id="remote-fields" style="display:none; margin-top:16px;">
-                    <div class="form-row">
-                        <div class="form-group">
-                            <label class="form-label">Target IP / Hostname</label>
-                            <input type="text" id="remote-ip" class="form-control" placeholder="192.168.1.100 or localhost">
-                        </div>
-                        <div class="form-group">
-                            <label class="form-label">SSH Port</label>
-                            <input type="text" id="remote-port" class="form-control" value="22" placeholder="22">
-                        </div>
-                    </div>
-                    <div class="form-row">
-                        <div class="form-group">
-                            <label class="form-label">SSH User</label>
-                            <input type="text" id="remote-user" class="form-control" value="root">
-                        </div>
-                    </div>
-
-                    <div class="form-group">
-                        <label class="form-label">Authentication Method</label>
-                        <div class="radio-group" style="gap:10px;">
-                            <label class="radio-card small">
-                                <input type="radio" name="auth_method" value="key" checked onchange="toggleAuthFields()">
-                                <div class="radio-body">
-                                    <span>🔑</span>
-                                    <div class="radio-label">SSH Key</div>
-                                </div>
-                            </label>
-                            <label class="radio-card small">
-                                <input type="radio" name="auth_method" value="password" onchange="toggleAuthFields()">
-                                <div class="radio-body">
-                                    <span>🔒</span>
-                                    <div class="radio-label">Password</div>
-                                </div>
-                            </label>
-                        </div>
-                    </div>
-
-                    <div id="key-field" class="form-group">
-                        <label class="form-label">SSH Key Path (on this server)</label>
-                        <input type="text" id="ssh-key-path" class="form-control" value="/root/.ssh/contabo-key" placeholder="/root/.ssh/id_rsa">
-                    </div>
-                    <div id="password-field" class="form-group" style="display:none;">
-                        <label class="form-label">SSH Password</label>
-                        <input type="password" id="ssh-password" class="form-control" placeholder="SSH password">
-                    </div>
-                </div>
-            </div>
-
-            <div class="form-section" style="border:none; padding-top:0;">
-                <button class="btn btn-danger btn-lg" onclick="launchRestore()" id="restore-btn">
-                    🚀 Start Restore
-                </button>
-                <p style="color:var(--gray); font-size:13px; margin-top:8px;">
-                    ⚠️ Restore will skip containers that are already running and healthy.
-                </p>
-            </div>
-        </div>
-
-        <div id="restore-log-wrapper" style="display:none; margin-top:20px;">
-            <div class="card-header" style="margin-bottom:10px;">
-                <div class="card-title"><span>📋</span><span>Restore Log</span></div>
-                <span id="restore-status-badge" class="badge badge-running">Running...</span>
-            </div>
-            <div id="restore-log" class="log-console"></div>
-            <div style="color:var(--gray); font-size:12px; margin-top:8px;" id="restore-elapsed"></div>
-        </div>
+{# ═══════════════════════════════════════════════════════
+   ALL CONTAINERS PAGE (root + all users)
+═══════════════════════════════════════════════════════ #}
+<div id="containers-page" class="page">
+  <div class="card">
+    <div class="card-header">
+      <div class="card-title"><i class="fas fa-layer-group"></i> All Containers</div>
+      <div style="display:flex;gap:8px;">
+        <span class="card-meta" id="all-ctr-meta">Loading…</span>
+        <button class="btn btn-ghost btn-sm" onclick="loadAllContainers()"><i class="fas fa-sync-alt"></i> Refresh</button>
+      </div>
     </div>
+    <div style="overflow-x:auto;">
+      <table class="ct-table">
+        <thead>
+          <tr>
+            <th>NAME</th>
+            <th>OWNER</th>
+            <th>STATUS</th>
+            <th>CPU</th>
+            <th>MEMORY</th>
+            <th>NET I/O</th>
+            <th>IMAGE</th>
+            <th>PORTS</th>
+          </tr>
+        </thead>
+        <tbody id="all-containers-body">
+          <tr><td colspan="8"><div class="empty-state"><i class="fas fa-spinner fa-spin"></i> Loading…</div></td></tr>
+        </tbody>
+      </table>
+    </div>
+  </div>
 </div>
 
-<div id="backups-page" class="page" style="display:none;">
-    <div class="card">
-        <div class="card-header">
-            <div class="card-title"><span>💾</span><span>Available Backups</span></div>
-            <button class="btn btn-secondary" onclick="refreshBackupsList()">🔄 Refresh</button>
-        </div>
-        <div class="two-column">
-            <div>
-                <h3 style="margin-bottom:12px;">🖥️ Main Server <small style="color:var(--gray); font-size:13px;">/root/backups/</small></h3>
-                <div class="backup-list" id="local-backup-list">
-                    {% for b in backups %}
-                    <div class="backup-item">
-                        <div class="backup-date">{{ b }}</div>
-                        <button class="btn btn-secondary btn-sm" onclick="quickRestore('local','{{ b }}')">↩ Restore here</button>
-                    </div>
-                    {% else %}
-                    <div class="backup-item">No local backups found</div>
-                    {% endfor %}
-                </div>
-            </div>
-            <div>
-                <h3 style="margin-bottom:12px;">💾 VM Server <small style="color:var(--gray); font-size:13px;">/backups/main-server/</small></h3>
-                <div class="backup-list" id="vm-backup-list">
-                    {% for b in vm_backups %}
-                    <div class="backup-item">
-                        <div class="backup-date">{{ b }}</div>
-                        <button class="btn btn-secondary btn-sm" onclick="quickRestore('vm','{{ b }}')">↩ Restore here</button>
-                    </div>
-                    {% else %}
-                    <div class="backup-item">No VM backups found</div>
-                    {% endfor %}
-                </div>
-            </div>
-        </div>
+{# ═══════════════════════════════════════════════════════
+   RESTORE PAGE
+═══════════════════════════════════════════════════════ #}
+<div id="restore-page" class="page">
+  <div class="card">
+    <div class="card-header">
+      <div class="card-title"><i class="fas fa-rotate-right"></i> Restore Configuration</div>
     </div>
-</div>
 
-<div id="settings-page" class="page" style="display:none;">
-    <div class="card">
-        <div class="card-header">
-            <div class="card-title"><span>⚙️</span><span>Platform Settings</span></div>
+    <div class="restore-form">
+
+      <!-- Step 1: Source -->
+      <div class="form-section">
+        <div class="form-section-title">STEP 1 — SELECT BACKUP SOURCE</div>
+        <div class="radio-group">
+          <label class="radio-card">
+            <input type="radio" name="backup_source" value="local" checked onchange="updateBackupList()">
+            <div class="radio-body">
+              <span class="radio-icon">🖥️</span>
+              <div>
+                <div class="radio-label">Main Server</div>
+                <div class="radio-desc"><code>/root/backups/</code></div>
+              </div>
+            </div>
+          </label>
+          <label class="radio-card">
+            <input type="radio" name="backup_source" value="vm" onchange="updateBackupList()">
+            <div class="radio-body">
+              <span class="radio-icon">💾</span>
+              <div>
+                <div class="radio-label">VM Backup Server</div>
+                <div class="radio-desc"><code>/backups/main-server/</code></div>
+              </div>
+            </div>
+          </label>
         </div>
-        <div style="max-width:500px;">
+
+        <div class="form-group" style="margin-top:14px; max-width:500px;">
+          <label class="form-label">BACKUP FILE</label>
+          <select id="backup-file-select" class="form-input">
+            <optgroup label="Main Server" id="local-options">
+              {% for b in backups %}
+              <option value="{{ b }}" data-source="local">{{ b }}</option>
+              {% else %}
+              <option disabled>No local backups</option>
+              {% endfor %}
+            </optgroup>
+            <optgroup label="VM Backups" id="vm-options" style="display:none;">
+              {% for b in vm_backups %}
+              <option value="{{ b }}" data-source="vm">{{ b }}</option>
+              {% else %}
+              <option disabled>No VM backups</option>
+              {% endfor %}
+            </optgroup>
+          </select>
+        </div>
+      </div>
+
+      <!-- Step 2: Target -->
+      <div class="form-section">
+        <div class="form-section-title">STEP 2 — SELECT RESTORE TARGET</div>
+        <div class="radio-group">
+          <label class="radio-card">
+            <input type="radio" name="restore_target" value="local" checked onchange="toggleRemoteFields()">
+            <div class="radio-body">
+              <span class="radio-icon">🎯</span>
+              <div>
+                <div class="radio-label">This Server</div>
+                <div class="radio-desc">{{ main_server }}</div>
+              </div>
+            </div>
+          </label>
+          <label class="radio-card">
+            <input type="radio" name="restore_target" value="remote" onchange="toggleRemoteFields()">
+            <div class="radio-body">
+              <span class="radio-icon">📡</span>
+              <div>
+                <div class="radio-label">Remote Machine</div>
+                <div class="radio-desc">via SSH</div>
+              </div>
+            </div>
+          </label>
+        </div>
+
+        <div id="remote-fields" style="display:none; margin-top:16px; max-width:560px;">
+          <div class="form-row">
             <div class="form-group">
-                <label class="form-label">Main Server IP</label>
-                <input type="text" value="{{ main_server }}" readonly class="form-control" style="background:var(--light);">
+              <label class="form-label">TARGET IP</label>
+              <input type="text" id="remote-ip" class="form-input" placeholder="192.168.1.x or localhost">
             </div>
-            <div class="form-group">
-                <label class="form-label">Platform Host</label>
-                <input type="text" value="Running on main server" readonly class="form-control" style="background:var(--light);">
+            <div class="form-group" style="max-width:100px;">
+              <label class="form-label">SSH PORT</label>
+              <input type="text" id="remote-port" class="form-input" value="22" placeholder="22">
             </div>
-            <div class="form-group">
-                <label class="form-label">VM Backup Path</label>
-                <input type="text" value="/backups/main-server/" readonly class="form-control" style="background:var(--light);">
+            <div class="form-group" style="max-width:120px;">
+              <label class="form-label">SSH USER</label>
+              <input type="text" id="remote-user" class="form-input" value="root">
             </div>
-            <button class="btn btn-secondary" onclick="refreshAll()">🔄 Refresh All Data</button>
+          </div>
+
+          <div class="form-group" style="margin-top:8px;">
+            <label class="form-label">AUTHENTICATION</label>
+            <div class="radio-group" style="gap:8px;">
+              <label class="radio-card small">
+                <input type="radio" name="auth_method" value="key" checked onchange="toggleAuthFields()">
+                <div class="radio-body"><span>🔑</span><div class="radio-label">SSH Key</div></div>
+              </label>
+              <label class="radio-card small">
+                <input type="radio" name="auth_method" value="password" onchange="toggleAuthFields()">
+                <div class="radio-body"><span>🔒</span><div class="radio-label">Password</div></div>
+              </label>
+            </div>
+          </div>
+
+          <div id="key-field" class="form-group" style="margin-top:8px;">
+            <label class="form-label">SSH KEY PATH</label>
+            <input type="text" id="ssh-key-path" class="form-input" value="/root/.ssh/contabo-key">
+          </div>
+          <div id="password-field" class="form-group" style="display:none; margin-top:8px;">
+            <label class="form-label">SSH PASSWORD</label>
+            <input type="password" id="ssh-password" class="form-input" placeholder="SSH password">
+          </div>
         </div>
+      </div>
+
+      <!-- Launch -->
+      <div class="form-section">
+        <button class="btn btn-danger btn-lg" onclick="launchRestore()" id="restore-btn">
+          <i class="fas fa-play"></i> Start Restore
+        </button>
+        <p style="color:var(--text3); font-size:12px; margin-top:8px;">
+          ⚠ Healthy running containers will be skipped automatically.
+        </p>
+      </div>
     </div>
+
+    <!-- Live Log -->
+    <div id="restore-log-wrapper" style="display:none; margin-top:20px;">
+      <div class="card-header" style="margin-bottom:10px;">
+        <div class="card-title"><i class="fas fa-terminal"></i> Restore Log</div>
+        <span class="badge" id="restore-status-badge" style="background:rgba(59,130,246,0.15);color:var(--accent2);">Running…</span>
+      </div>
+      <div id="restore-log" class="log-console"></div>
+      <div style="color:var(--text3); font-size:11px; margin-top:6px; font-family:var(--mono);" id="restore-elapsed"></div>
+    </div>
+  </div>
 </div>
 
+{# ═══════════════════════════════════════════════════════
+   BACKUPS PAGE
+═══════════════════════════════════════════════════════ #}
+<div id="backups-page" class="page">
+  <div class="card">
+    <div class="card-header">
+      <div class="card-title"><i class="fas fa-database"></i> Available Backups</div>
+      <button class="btn btn-ghost btn-sm" onclick="refreshBackupsList()"><i class="fas fa-sync-alt"></i> Refresh</button>
+    </div>
+    <div class="two-col">
+      <div>
+        <div class="section-header">
+          <div class="section-title">🖥️ MAIN SERVER</div>
+          <span class="card-meta">/root/backups/</span>
+        </div>
+        <div class="backup-list" id="local-backup-list">
+          {% for b in backups %}
+          <div class="backup-item">
+            <span class="backup-name">{{ b }}</span>
+            <button class="btn btn-ghost btn-sm" onclick="quickRestore('local','{{ b }}')">↩ Restore</button>
+          </div>
+          {% else %}
+          <div class="empty-state"><i class="fas fa-inbox"></i>No backups</div>
+          {% endfor %}
+        </div>
+      </div>
+      <div>
+        <div class="section-header">
+          <div class="section-title">💾 VM SERVER</div>
+          <span class="card-meta">/backups/main-server/</span>
+        </div>
+        <div class="backup-list" id="vm-backup-list">
+          {% for b in vm_backups %}
+          <div class="backup-item">
+            <span class="backup-name">{{ b }}</span>
+            <button class="btn btn-ghost btn-sm" onclick="quickRestore('vm','{{ b }}')">↩ Restore</button>
+          </div>
+          {% else %}
+          <div class="empty-state"><i class="fas fa-inbox"></i>No VM backups</div>
+          {% endfor %}
+        </div>
+      </div>
+    </div>
+  </div>
+</div>
+
+{# ═══════════════════════════════════════════════════════
+   USERS PAGE
+═══════════════════════════════════════════════════════ #}
+<div id="users-page" class="page">
+
+  <!-- Create User -->
+  <div class="card">
+    <div class="card-header">
+      <div class="card-title"><i class="fas fa-user-plus"></i> Create New User</div>
+    </div>
+    <div class="form-grid">
+      <div class="form-group">
+        <label class="form-label">USERNAME</label>
+        <input type="text" id="new-username" class="form-input" placeholder="e.g. secuser2">
+      </div>
+      <div class="form-group">
+        <label class="form-label">PASSWORD (optional)</label>
+        <input type="password" id="new-password" class="form-input" placeholder="Leave blank for no password">
+      </div>
+      <div class="form-group">
+        <label class="form-label">DISK QUOTA (MB, optional)</label>
+        <input type="number" id="new-quota" class="form-input" placeholder="e.g. 10240 for 10GB">
+      </div>
+      <div class="form-group" style="justify-content:flex-end;">
+        <label class="form-check" style="margin-bottom:8px;">
+          <input type="checkbox" id="new-docker" checked>
+          <span>Setup rootless Docker</span>
+        </label>
+        <button class="btn btn-primary" onclick="createUser()">
+          <i class="fas fa-plus"></i> Create User
+        </button>
+      </div>
+    </div>
+    <div id="create-user-result" class="alert" style="margin-top:14px;"></div>
+    <div id="create-user-log" class="log-console" style="display:none; margin-top:12px; max-height:200px;"></div>
+  </div>
+
+  <!-- Users List -->
+  <div class="card">
+    <div class="card-header">
+      <div class="card-title"><i class="fas fa-users"></i> System Users</div>
+      <button class="btn btn-ghost btn-sm" onclick="loadUsers()"><i class="fas fa-sync-alt"></i> Refresh</button>
+    </div>
+    <div class="users-grid" id="users-grid">
+      {% for u in users %}
+      <div class="user-card" onclick="loadUserContainers('{{ u.name }}')">
+        <div class="user-card-top">
+          <div class="user-avatar" style="background: #667eea">
+            {{ u.name[0].upper() }}
+          </div>
+          <div>
+            <div class="user-name">{{ u.name }}</div>
+            <div class="user-uid">uid {{ u.uid }} · {{ u.home }}</div>
+          </div>
+        </div>
+        <div class="user-tags">
+          {% if u.has_docker %}<span class="user-tag docker"><i class="fab fa-docker"></i> rootless docker</span>{% endif %}
+          {% if u.linger %}<span class="user-tag linger">linger on</span>{% endif %}
+        </div>
+        <div class="user-stats">
+          <div class="user-stat">Disk: <strong>{{ u.disk_used }}</strong></div>
+          <div class="user-stat">Containers: <strong>{{ u.container_count }}</strong></div>
+        </div>
+      </div>
+      {% else %}
+      <div class="empty-state" style="grid-column:1/-1;">
+        <i class="fas fa-user-slash"></i>No non-system users found
+      </div>
+      {% endfor %}
+    </div>
+  </div>
+
+  <!-- User Detail Panel -->
+  <div class="card" id="user-detail-panel" style="display:none;">
+    <div class="card-header">
+      <div class="card-title"><i class="fas fa-cube"></i> <span id="user-detail-title">Containers</span></div>
+      <div style="display:flex;gap:8px;">
+        <button class="btn btn-ghost btn-sm" id="user-delete-btn" onclick="deleteUser()">
+          <i class="fas fa-trash"></i> Delete User
+        </button>
+        <button class="btn btn-ghost btn-sm" onclick="document.getElementById('user-detail-panel').style.display='none'">
+          ✕ Close
+        </button>
+      </div>
+    </div>
+    <div style="overflow-x:auto;">
+      <table class="ct-table">
+        <thead>
+          <tr><th>NAME</th><th>STATUS</th><th>IMAGE</th><th>PORTS</th></tr>
+        </thead>
+        <tbody id="user-containers-body">
+          <tr><td colspan="4"><div class="empty-state"><i class="fas fa-spinner fa-spin"></i></div></td></tr>
+        </tbody>
+      </table>
+    </div>
+    <div id="user-action-result" class="alert" style="margin-top:14px;"></div>
+  </div>
+</div>
+
+{# ═══════════════════════════════════════════════════════
+   SETTINGS PAGE
+═══════════════════════════════════════════════════════ #}
+<div id="settings-page" class="page">
+  <div class="card">
+    <div class="card-header">
+      <div class="card-title"><i class="fas fa-sliders"></i> Platform Settings</div>
+    </div>
+    <div style="max-width:460px; display:flex; flex-direction:column; gap:14px;">
+      <div class="form-group">
+        <label class="form-label">MAIN SERVER IP</label>
+        <input class="form-input" value="{{ main_server }}" readonly>
+      </div>
+      <div class="form-group">
+        <label class="form-label">VM BACKUP PATH</label>
+        <input class="form-input" value="/backups/main-server/" readonly>
+      </div>
+      <div class="form-group">
+        <label class="form-label">PLATFORM UPTIME</label>
+        <input class="form-input" id="settings-uptime" value="{{ system.uptime }}" readonly>
+      </div>
+      <div class="form-group">
+        <label class="form-label">DOCKER VERSION</label>
+        <input class="form-input" value="{{ system.docker_v }}" readonly>
+      </div>
+      <button class="btn btn-ghost" onclick="refreshAll()"><i class="fas fa-sync-alt"></i> Refresh All Data</button>
+    </div>
+  </div>
+</div>
+
+{# ═══════════════════════════════════════════════════════
+   JAVASCRIPT
+═══════════════════════════════════════════════════════ #}
 <script>
-function updateBackupList() {
-    const source = document.querySelector('input[name="backup_source"]:checked').value;
-    const sel = document.getElementById('backup-file-select');
-    document.getElementById('local-options').style.display = source === 'local' ? '' : 'none';
-    document.getElementById('vm-options').style.display   = source === 'vm'    ? '' : 'none';
-    for (let opt of sel.options) {
-        if (!opt.disabled && opt.parentElement.style.display !== 'none') {
-            opt.selected = true;
-            break;
-        }
+// ── Page routing ────────────────────────────────────────
+const PAGES = {
+  'dashboard':  { title: 'Dashboard',      sub: '{{ main_server }}' },
+  'containers': { title: 'All Containers', sub: 'root + all users' },
+  'restore':    { title: 'Restore',        sub: 'backup → target'  },
+  'backups':    { title: 'Backups',        sub: 'local & VM'       },
+  'users':      { title: 'User Management',sub: 'linux + docker'   },
+  'settings':   { title: 'Settings',       sub: 'platform config'  },
+};
+
+function showPage(name) {
+  document.querySelectorAll('.page').forEach(p => p.classList.remove('active'));
+  document.querySelectorAll('.nav-item').forEach(n => n.classList.remove('active'));
+  const page = document.getElementById(name + '-page');
+  if (page) page.classList.add('active');
+  const nav = document.querySelector(`[data-page="${name}"]`);
+  if (nav) nav.classList.add('active');
+  const info = PAGES[name] || {};
+  document.getElementById('page-title').textContent   = info.title || name;
+  document.getElementById('page-subtitle').textContent = info.sub   || '';
+  // Lazy load
+  if (name === 'containers') loadAllContainers();
+  if (name === 'backups')    refreshBackupsList();
+  if (name === 'users')      loadUsers();
+}
+
+document.querySelectorAll('.nav-item').forEach(item => {
+  item.addEventListener('click', e => {
+    e.preventDefault();
+    showPage(item.dataset.page);
+  });
+});
+
+// ── Server status ────────────────────────────────────────
+async function checkServerStatus() {
+  try {
+    const r = await fetch('/server/status');
+    const d = await r.json();
+    const dot  = document.getElementById('pulse-dot');
+    const text = document.getElementById('server-status-text');
+    if (d.status === 'online') {
+      dot.className = 'pulse-dot online';
+      text.textContent = 'Online';
+    } else {
+      dot.className = 'pulse-dot offline';
+      text.textContent = 'Offline';
     }
+  } catch { }
+}
+
+// ── System metrics ───────────────────────────────────────
+async function refreshSystemMetrics() {
+  try {
+    const r = await fetch('/api/system');
+    const d = await r.json();
+    document.getElementById('m-cpu').innerHTML  = d.cpu_pct + '<span>%</span>';
+    document.getElementById('m-mem').textContent = d.memory;
+    document.getElementById('m-disk').textContent = d.disk;
+    document.getElementById('m-load').textContent = d.load;
+    document.getElementById('g-cpu').style.width  = Math.min(parseFloat(d.cpu_pct)||0, 100) + '%';
+    document.getElementById('g-mem').style.width  = Math.min(parseFloat(d.mem_pct)||0, 100) + '%';
+    document.getElementById('g-disk').style.width = Math.min(parseFloat(d.disk_pct)||0, 100) + '%';
+    document.getElementById('uptime-chip').textContent = d.uptime;
+    const settingsUptime = document.getElementById('settings-uptime');
+    if (settingsUptime) settingsUptime.value = d.uptime;
+  } catch { }
+}
+
+// ── Container stats (live) ───────────────────────────────
+async function refreshContainerStats() {
+  try {
+    const r = await fetch('/api/stats');
+    const stats = await r.json();
+
+    document.querySelectorAll('[data-stat]').forEach(el => {
+      const name = el.dataset.ctr;
+      const stat = el.dataset.stat;
+      const s = stats[name];
+      if (!s) return;
+
+      if (stat === 'cpu')     el.textContent = s.cpu     || '—';
+      if (stat === 'net')     el.textContent = s.net     || '—';
+      if (stat === 'block')   el.textContent = s.block   || '—';
+      if (stat === 'mem_pct') el.textContent = s.mem_pct || '—';
+      if (stat === 'mem_bar') {
+        const pct = parseFloat(s.mem_pct) || 0;
+        el.style.width = Math.min(pct, 100) + '%';
+        el.className = 'stat-bar-fill' + (pct > 85 ? ' crit' : pct > 65 ? ' warn' : '');
+      }
+    });
+  } catch { }
+}
+
+// ── All containers (root + users) ───────────────────────
+async function loadAllContainers() {
+  const body = document.getElementById('all-containers-body');
+  const meta = document.getElementById('all-ctr-meta');
+  body.innerHTML = '<tr><td colspan="8"><div class="empty-state"><i class="fas fa-spinner fa-spin"></i> Loading…</div></td></tr>';
+
+  try {
+    const [ctrRes, statRes] = await Promise.all([
+      fetch('/api/containers/all'),
+      fetch('/api/stats')
+    ]);
+    const { containers, running } = await ctrRes.json();
+    const stats = await statRes.json();
+
+    meta.textContent = `${containers.length} total · ${running} running`;
+    document.getElementById('nav-badge-containers').textContent = containers.length;
+
+    if (!containers.length) {
+      body.innerHTML = '<tr><td colspan="8"><div class="empty-state"><i class="fas fa-inbox"></i>No containers</div></td></tr>';
+      return;
+    }
+    body.innerHTML = containers.map(c => {
+      const up  = c.status.includes('Up');
+      const s   = stats[c.name] || {};
+      const pct = parseFloat(s.mem_pct) || 0;
+      const cls = pct > 85 ? 'crit' : pct > 65 ? 'warn' : '';
+      return `<tr>
+        <td class="ct-name">${c.name}</td>
+        <td class="ct-owner">${c.owner}</td>
+        <td>${up ? '<span class="badge badge-run">Running</span>' : '<span class="badge badge-stop">Stopped</span>'}</td>
+        <td><span class="stat-pct">${s.cpu||'—'}</span></td>
+        <td>
+          <div class="stat-bar-wrap">
+            <div class="stat-bar-bg"><div class="stat-bar-fill ${cls}" style="width:${Math.min(pct,100)}%"></div></div>
+            <span class="stat-pct">${s.mem_pct||'—'}</span>
+          </div>
+        </td>
+        <td><span class="stat-pct" style="color:var(--cyan)">${s.net||'—'}</span></td>
+        <td class="ct-image">${c.image}</td>
+        <td class="ct-ports">${c.ports||'—'}</td>
+      </tr>`;
+    }).join('');
+  } catch (e) {
+    body.innerHTML = `<tr><td colspan="8"><div class="empty-state"><i class="fas fa-exclamation-triangle"></i>${e}</div></td></tr>`;
+  }
+}
+
+// ── Backups ──────────────────────────────────────────────
+async function refreshBackupsList() {
+  try {
+    const r = await fetch('/api/backups');
+    const d = await r.json();
+    renderBackupList(d.local, 'local-backup-list', 'local');
+    renderBackupList(d.vm,    'vm-backup-list',    'vm');
+    document.getElementById('stat-local-bk').textContent = d.local.length;
+    document.getElementById('stat-vm-bk').textContent    = d.vm.length;
+
+    // Refresh selects on restore page
+    const lo = document.getElementById('local-options');
+    const vo = document.getElementById('vm-options');
+    lo.innerHTML = d.local.length
+      ? d.local.map(b => `<option value="${b}" data-source="local">${b}</option>`).join('')
+      : '<option disabled>No local backups</option>';
+    vo.innerHTML = d.vm.length
+      ? d.vm.map(b => `<option value="${b}" data-source="vm">${b}</option>`).join('')
+      : '<option disabled>No VM backups</option>';
+  } catch { }
+}
+
+function renderBackupList(items, id, source) {
+  const el = document.getElementById(id);
+  if (!el) return;
+  if (!items || !items.length) {
+    el.innerHTML = '<div class="empty-state"><i class="fas fa-inbox"></i>No backups</div>';
+    return;
+  }
+  el.innerHTML = items.map(b => `
+    <div class="backup-item">
+      <span class="backup-name">${b}</span>
+      <button class="btn btn-ghost btn-sm" onclick="quickRestore('${source}','${b}')">↩ Restore</button>
+    </div>`).join('');
+}
+
+// ── Users ────────────────────────────────────────────────
+let selectedUser = null;
+
+async function loadUsers() {
+  try {
+    const r = await fetch('/api/users');
+    const users = await r.json();
+    document.getElementById('nav-badge-users').textContent = users.length;
+    document.getElementById('stat-users').textContent = users.length;
+
+    const colors = ['#3b82f6','#a78bfa','#22c55e','#f59e0b','#ef4444','#22d3ee'];
+    const grid = document.getElementById('users-grid');
+    if (!users.length) {
+      grid.innerHTML = '<div class="empty-state" style="grid-column:1/-1"><i class="fas fa-user-slash"></i>No users</div>';
+      return;
+    }
+    grid.innerHTML = users.map((u, i) => `
+      <div class="user-card" onclick="loadUserContainers('${u.name}')">
+        <div class="user-card-top">
+          <div class="user-avatar" style="background:${colors[i % colors.length]}">${u.name[0].toUpperCase()}</div>
+          <div>
+            <div class="user-name">${u.name}</div>
+            <div class="user-uid">uid ${u.uid} · ${u.home}</div>
+          </div>
+        </div>
+        <div class="user-tags">
+          ${u.has_docker ? '<span class="user-tag docker"><i class="fab fa-docker"></i> rootless docker</span>' : ''}
+          ${u.linger ? '<span class="user-tag linger">linger on</span>' : ''}
+        </div>
+        <div class="user-stats">
+          <div class="user-stat">Disk: <strong>${u.disk_used}</strong></div>
+          <div class="user-stat">Containers: <strong>${u.container_count}</strong></div>
+        </div>
+      </div>`).join('');
+  } catch { }
+}
+
+async function loadUserContainers(username) {
+  selectedUser = username;
+  const panel = document.getElementById('user-detail-panel');
+  panel.style.display = '';
+  document.getElementById('user-detail-title').textContent = `${username}'s Containers`;
+  document.getElementById('user-delete-btn').dataset.username = username;
+  document.getElementById('user-action-result').className = 'alert';
+
+  const body = document.getElementById('user-containers-body');
+  body.innerHTML = '<tr><td colspan="4"><div class="empty-state"><i class="fas fa-spinner fa-spin"></i></div></td></tr>';
+
+  try {
+    const r = await fetch(`/api/users/${username}/containers`);
+    const ctrs = await r.json();
+    if (!ctrs.length) {
+      body.innerHTML = '<tr><td colspan="4"><div class="empty-state"><i class="fas fa-inbox"></i>No containers</div></td></tr>';
+      return;
+    }
+    body.innerHTML = ctrs.map(c => {
+      const up = c.status.includes('Up');
+      return `<tr>
+        <td class="ct-name">${c.name}</td>
+        <td>${up ? '<span class="badge badge-run">Running</span>' : '<span class="badge badge-stop">Stopped</span>'}</td>
+        <td class="ct-image">${c.image}</td>
+        <td class="ct-ports">${c.ports||'—'}</td>
+      </tr>`;
+    }).join('');
+    panel.scrollIntoView({ behavior: 'smooth' });
+  } catch (e) {
+    body.innerHTML = `<tr><td colspan="4"><div class="empty-state">${e}</div></td></tr>`;
+  }
+}
+
+async function createUser() {
+  const username = document.getElementById('new-username').value.trim();
+  const password = document.getElementById('new-password').value.trim();
+  const quota    = document.getElementById('new-quota').value.trim();
+  const docker   = document.getElementById('new-docker').checked;
+
+  if (!username) { showAlert('create-user-result', 'error', 'Username is required'); return; }
+
+  const btn = event.target;
+  btn.disabled = true;
+  btn.textContent = 'Creating…';
+
+  const logEl = document.getElementById('create-user-log');
+  logEl.style.display = '';
+  logEl.textContent = '⏳ Setting up user…\n';
+
+  try {
+    const r = await fetch('/api/users/create', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        username,
+        password: password || null,
+        setup_docker: docker,
+        disk_quota_mb: quota ? parseInt(quota) : null,
+      })
+    });
+    const d = await r.json();
+    logEl.textContent = d.message || '';
+    if (d.success) {
+      showAlert('create-user-result', 'success', `✅ User "${username}" created successfully`);
+      document.getElementById('new-username').value = '';
+      document.getElementById('new-password').value = '';
+      document.getElementById('new-quota').value = '';
+      loadUsers();
+    } else {
+      showAlert('create-user-result', 'error', `❌ ${d.message}`);
+    }
+  } catch (e) {
+    showAlert('create-user-result', 'error', `Request failed: ${e}`);
+  } finally {
+    btn.disabled = false;
+    btn.innerHTML = '<i class="fas fa-plus"></i> Create User';
+  }
+}
+
+async function deleteUser() {
+  const username = selectedUser;
+  if (!username) return;
+  if (!confirm(`Delete user "${username}"? This cannot be undone.\nRemove home directory too?`)) return;
+  const removeHome = confirm(`Also delete /home/${username}?`);
+
+  try {
+    const r = await fetch('/api/users/delete', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ username, remove_home: removeHome })
+    });
+    const d = await r.json();
+    showAlert('user-action-result', d.success ? 'success' : 'error', d.message);
+    if (d.success) {
+      document.getElementById('user-detail-panel').style.display = 'none';
+      loadUsers();
+    }
+  } catch (e) {
+    showAlert('user-action-result', 'error', `Request failed: ${e}`);
+  }
+}
+
+function showAlert(id, type, msg) {
+  const el = document.getElementById(id);
+  el.className = `alert alert-${type} show`;
+  el.textContent = msg;
+}
+
+// ── Restore form ─────────────────────────────────────────
+function updateBackupList() {
+  const src = document.querySelector('input[name="backup_source"]:checked').value;
+  document.getElementById('local-options').style.display = src === 'local' ? '' : 'none';
+  document.getElementById('vm-options').style.display    = src === 'vm'    ? '' : 'none';
+  const sel = document.getElementById('backup-file-select');
+  for (let opt of sel.options) {
+    if (!opt.disabled && opt.parentElement.style.display !== 'none') { opt.selected = true; break; }
+  }
 }
 
 function toggleRemoteFields() {
-    const target = document.querySelector('input[name="restore_target"]:checked').value;
-    document.getElementById('remote-fields').style.display = target === 'remote' ? '' : 'none';
+  const t = document.querySelector('input[name="restore_target"]:checked').value;
+  document.getElementById('remote-fields').style.display = t === 'remote' ? '' : 'none';
 }
 
 function toggleAuthFields() {
-    const method = document.querySelector('input[name="auth_method"]:checked').value;
-    document.getElementById('key-field').style.display      = method === 'key'      ? '' : 'none';
-    document.getElementById('password-field').style.display = method === 'password' ? '' : 'none';
+  const m = document.querySelector('input[name="auth_method"]:checked').value;
+  document.getElementById('key-field').style.display      = m === 'key'      ? '' : 'none';
+  document.getElementById('password-field').style.display = m === 'password' ? '' : 'none';
 }
 
 function quickRestore(source, filename) {
-    showPage('restore');
-    document.querySelector(`input[name="backup_source"][value="${source}"]`).checked = true;
-    updateBackupList();
-    const sel = document.getElementById('backup-file-select');
-    for (let opt of sel.options) {
-        if (opt.value === filename) { opt.selected = true; break; }
-    }
-    document.querySelector('input[name="restore_target"][value="local"]').checked = true;
-    toggleRemoteFields();
-    window.scrollTo(0, 0);
+  showPage('restore');
+  document.querySelector(`input[name="backup_source"][value="${source}"]`).checked = true;
+  updateBackupList();
+  const sel = document.getElementById('backup-file-select');
+  for (let opt of sel.options) { if (opt.value === filename) { opt.selected = true; break; } }
+  document.querySelector('input[name="restore_target"][value="local"]').checked = true;
+  toggleRemoteFields();
+  window.scrollTo(0, 0);
 }
 
 let currentJobId = null;
 let pollInterval = null;
 
 async function launchRestore() {
-    const source = document.querySelector('input[name="backup_source"]:checked').value;
-    const file   = document.getElementById('backup-file-select').value;
-    const target = document.querySelector('input[name="restore_target"]:checked').value;
+  const src    = document.querySelector('input[name="backup_source"]:checked').value;
+  const file   = document.getElementById('backup-file-select').value;
+  const target = document.querySelector('input[name="restore_target"]:checked').value;
 
-    if (!file || file === 'undefined') {
-        alert('Please select a backup file.');
-        return;
-    }
-
-    const payload = {
-        backup_source: source,
-        backup_file:   file,
-        target:        target,
-    };
-
-    if (target === 'remote') {
-        payload.remote_ip   = document.getElementById('remote-ip').value.trim();
-        payload.remote_port = document.getElementById('remote-port').value.trim() || '22';
-        payload.remote_user = document.getElementById('remote-user').value.trim();
-        payload.auth_method = document.querySelector('input[name="auth_method"]:checked').value;
-        if (payload.auth_method === 'key') {
-            payload.ssh_key_path = document.getElementById('ssh-key-path').value.trim();
-        } else {
-            payload.ssh_password = document.getElementById('ssh-password').value;
-        }
-        if (!payload.remote_ip) {
-            alert('Please enter the target IP address.');
-            return;
-        }
-    }
-
-    if (!confirm(`Start restore of "${file}" → ${target === 'local' ? 'this server' : payload.remote_ip}:${payload.remote_port || 22}?`)) return;
-
-    const btn = document.getElementById('restore-btn');
-    btn.disabled = true;
-    btn.textContent = '⏳ Starting...';
-
-    document.getElementById('restore-log-wrapper').style.display = '';
-    document.getElementById('restore-log').innerHTML = '';
-    document.getElementById('restore-status-badge').className = 'badge badge-running';
-    document.getElementById('restore-status-badge').textContent = 'Running...';
-
-    try {
-        const res = await fetch('/restore/start', {
-            method: 'POST',
-            headers: {'Content-Type': 'application/json'},
-            body: JSON.stringify(payload)
-        });
-        const data = await res.json();
-        if (data.error) {
-            appendLog('❌ ERROR: ' + data.error);
-            btn.disabled = false;
-            btn.textContent = '🚀 Start Restore';
-            return;
-        }
-        currentJobId = data.job_id;
-        pollRestore();
-    } catch (e) {
-        appendLog('❌ Request failed: ' + e);
-        btn.disabled = false;
-        btn.textContent = '🚀 Start Restore';
+  if (!file || file === 'undefined') { alert('Select a backup file first.'); return; }
+
+  const payload = { backup_source: src, backup_file: file, target };
+
+  if (target === 'remote') {
+    payload.remote_ip   = document.getElementById('remote-ip').value.trim();
+    payload.remote_port = document.getElementById('remote-port').value.trim() || '22';
+    payload.remote_user = document.getElementById('remote-user').value.trim() || 'root';
+    payload.auth_method = document.querySelector('input[name="auth_method"]:checked').value;
+    if (payload.auth_method === 'key')
+      payload.ssh_key_path = document.getElementById('ssh-key-path').value.trim();
+    else
+      payload.ssh_password = document.getElementById('ssh-password').value;
+    if (!payload.remote_ip) { alert('Enter a target IP.'); return; }
+  }
+
+  if (!confirm(`Restore "${file}" → ${target === 'local' ? 'this server' : payload.remote_ip + ':' + payload.remote_port}?`)) return;
+
+  const btn = document.getElementById('restore-btn');
+  btn.disabled = true;
+  btn.innerHTML = '<i class="fas fa-spinner fa-spin"></i> Starting…';
+
+  const wrapper = document.getElementById('restore-log-wrapper');
+  wrapper.style.display = '';
+  document.getElementById('restore-log').innerHTML = '';
+  const badge = document.getElementById('restore-status-badge');
+  badge.style = 'background:rgba(59,130,246,0.15);color:var(--accent2)';
+  badge.textContent = 'Running…';
+
+  try {
+    const res  = await fetch('/restore/start', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(payload)
+    });
+    const data = await res.json();
+    if (data.error) {
+      appendLog('❌ ' + data.error, 'error');
+      btn.disabled = false; btn.innerHTML = '<i class="fas fa-play"></i> Start Restore';
+      return;
     }
+    currentJobId = data.job_id;
+    pollRestore();
+  } catch (e) {
+    appendLog('❌ ' + e, 'error');
+    btn.disabled = false; btn.innerHTML = '<i class="fas fa-play"></i> Start Restore';
+  }
 }
 
 function pollRestore() {
-    if (pollInterval) clearInterval(pollInterval);
-    let lastLine = 0;
-    pollInterval = setInterval(async () => {
-        if (!currentJobId) return;
-        try {
-            const res  = await fetch(`/restore/status/${currentJobId}`);
-            const data = await res.json();
-            const newLines = data.log.slice(lastLine);
-            newLines.forEach(l => appendLog(l));
-            lastLine = data.log.length;
-            document.getElementById('restore-elapsed').textContent = `⏱ Elapsed: ${data.elapsed}s`;
-            if (data.status !== 'running') {
-                clearInterval(pollInterval);
-                const badge = document.getElementById('restore-status-badge');
-                if (data.status === 'done') {
-                    badge.className = 'badge badge-running';
-                    badge.textContent = '✅ Done';
-                    badge.style.background = '#22c55e';
-                } else {
-                    badge.className = 'badge badge-stopped';
-                    badge.textContent = '❌ Error';
-                }
-                const btn = document.getElementById('restore-btn');
-                btn.disabled = false;
-                btn.textContent = '🚀 Start Restore';
-            }
-        } catch (e) { }
-    }, 1500);
+  if (pollInterval) clearInterval(pollInterval);
+  let lastLine = 0;
+  pollInterval = setInterval(async () => {
+    if (!currentJobId) return;
+    try {
+      const r = await fetch(`/restore/status/${currentJobId}`);
+      const d = await r.json();
+      d.log.slice(lastLine).forEach(l => appendLog(l));
+      lastLine = d.log.length;
+      document.getElementById('restore-elapsed').textContent = `⏱ ${d.elapsed}s elapsed`;
+
+      if (d.status !== 'running') {
+        clearInterval(pollInterval);
+        const badge = document.getElementById('restore-status-badge');
+        if (d.status === 'done') {
+          badge.style = 'background:rgba(34,197,94,0.15);color:var(--green)';
+          badge.textContent = '✅ Done';
+        } else {
+          badge.style = 'background:rgba(239,68,68,0.15);color:var(--red)';
+          badge.textContent = '❌ Error';
+        }
+        const btn = document.getElementById('restore-btn');
+        btn.disabled = false;
+        btn.innerHTML = '<i class="fas fa-play"></i> Start Restore';
+      }
+    } catch { }
+  }, 1500);
 }
 
-function appendLog(line) {
-    const el = document.getElementById('restore-log');
-    const div = document.createElement('div');
-    div.className = 'log-line';
-    if (line.includes('✅'))  div.style.color = '#4ade80';
-    else if (line.includes('❌') || line.includes('ERROR')) div.style.color = '#f87171';
-    else if (line.includes('⚠️'))  div.style.color = '#fbbf24';
-    else if (line.includes('📌') || line.includes('Step')) div.style.color = '#60a5fa';
-    div.textContent = line;
-    el.appendChild(div);
-    el.scrollTop = el.scrollHeight;
+function appendLog(line, type) {
+  const el  = document.getElementById('restore-log');
+  const div = document.createElement('div');
+  div.className = 'log-line';
+  if      (line.includes('✅') || type === 'ok')    div.style.color = 'var(--green)';
+  else if (line.includes('❌') || type === 'error')  div.style.color = 'var(--red)';
+  else if (line.includes('⚠️'))                      div.style.color = 'var(--yellow)';
+  else if (line.includes('📌') || line.includes('STEP')) div.style.color = 'var(--accent2)';
+  else if (line.includes('📤') || line.includes('🚀'))   div.style.color = 'var(--cyan)';
+  div.textContent = line;
+  el.appendChild(div);
+  el.scrollTop = el.scrollHeight;
 }
 
-async function refreshBackupsList() {
-    const res  = await fetch('/api/backups');
-    const data = await res.json();
-    const renderList = (items, containerId, source) => {
-        const el = document.getElementById(containerId);
-        if (!items.length) { el.innerHTML = '<div class="backup-item">No backups found</div>'; return; }
-        el.innerHTML = items.map(b => `
-            <div class="backup-item">
-                <div class="backup-date">${b}</div>
-                <button class="btn btn-secondary btn-sm" onclick="quickRestore('${source}','${b}')">↩ Restore here</button>
-            </div>`).join('');
-    };
-    renderList(data.local, 'local-backup-list', 'local');
-    renderList(data.vm,    'vm-backup-list',    'vm');
-    document.getElementById('stat-local').textContent = data.local.length;
-    document.getElementById('stat-vm').textContent    = data.vm.length;
-    const localOpts = document.getElementById('local-options');
-    const vmOpts    = document.getElementById('vm-options');
-    localOpts.innerHTML = data.local.length ? data.local.map(b => `<option value="${b}" data-source="local">${b}</option>`).join('') : '<option disabled>No local backups found</option>';
-    vmOpts.innerHTML = data.vm.length ? data.vm.map(b => `<option value="${b}" data-source="vm">${b}</option>`).join('') : '<option disabled>No VM backups found</option>';
+// ── Global refresh ───────────────────────────────────────
+function refreshAll() {
+  const icon = document.getElementById('refresh-icon');
+  const btn  = icon.closest('.icon-btn');
+  btn.classList.add('spinning');
+  Promise.all([
+    checkServerStatus(),
+    refreshSystemMetrics(),
+    refreshContainerStats(),
+  ]).finally(() => btn.classList.remove('spinning'));
 }
 
-async function refreshContainers() {
-    const res  = await fetch('/api/containers');
-    const data = await res.json();
-    document.getElementById('stat-total').textContent   = data.containers.length;
-    document.getElementById('stat-running').textContent = data.running;
-    document.getElementById('container-count').textContent = data.containers.length + ' containers';
-    const grid = document.getElementById('containers-grid');
-    grid.innerHTML = data.containers.map(c => {
-        const up = c.status.includes('Up');
-        return `<div class="container-card ${up ? 'running' : 'stopped'}">
-            <div class="container-name">
-                <span>${c.name}</span>
-                <span class="badge ${up ? 'badge-running' : 'badge-stopped'}">${up ? 'Running' : 'Stopped'}</span>
-            </div>
-            <div class="container-status">${c.status}</div>
-        </div>`;
-    }).join('');
-}
+// ── Boot ─────────────────────────────────────────────────
+checkServerStatus();
+refreshSystemMetrics();
+refreshContainerStats();
+document.getElementById('nav-badge-users').textContent = '{{ users|length }}';
+document.getElementById('nav-badge-containers').textContent = '{{ containers|length }}';
 
-function refreshAll() { refreshContainers(); refreshBackupsList(); }
-
-function showPage(pageId) {
-    document.querySelectorAll('.nav-item').forEach(nav => nav.classList.remove('active'));
-    document.querySelectorAll('.page').forEach(p => p.style.display = 'none');
-    document.getElementById(pageId + '-page').style.display = 'block';
-    const titles = {dashboard: 'Dashboard Overview', restore: 'Restore Actions', backups: 'Backup Management', settings: 'Platform Settings'};
-    const titleElement = document.getElementById('page-title');
-    if (titleElement) titleElement.textContent = titles[pageId];
-}
-
-document.addEventListener('DOMContentLoaded', () => {
-    checkServerStatus();
-});
+// Auto-refresh every 15s
+setInterval(() => {
+  refreshSystemMetrics();
+  refreshContainerStats();
+}, 15000);
+setInterval(checkServerStatus, 30000);
 </script>
 {% endblock %}
diff --git a/platform/templates/login.html b/platform/templates/login.html
index 11ae50e..ce1e0f6 100644
--- a/platform/templates/login.html
+++ b/platform/templates/login.html
@@ -4,48 +4,76 @@
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>Navitrends — Login</title>
-    <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap" rel="stylesheet">
+    <link rel="preconnect" href="https://fonts.googleapis.com">
+    <link href="https://fonts.googleapis.com/css2?family=Syne:wght@400;600;700;800&family=Geist+Mono:wght@400;500&display=swap" rel="stylesheet">
     <style>
         *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
         body {
-            font-family: 'Inter', sans-serif;
-            display: flex; justify-content: center; align-items: center;
-            min-height: 100vh;
-            background: linear-gradient(135deg, #1e1b4b 0%, #312e81 50%, #4338ca 100%);
+            font-family: 'Syne', sans-serif;
+            background: #0a0b0e;
+            display: flex; align-items: center; justify-content: center;
+            min-height: 100vh; color: #e8ecf4;
         }
-        .login-card {
-            background: white; border-radius: 24px;
-            padding: 48px 40px; width: 380px;
-            text-align: center;
-            box-shadow: 0 25px 60px rgba(0,0,0,0.3);
+        body::before {
+            content: ''; position: fixed; inset: 0;
+            background-image:
+                linear-gradient(rgba(59,130,246,0.03) 1px, transparent 1px),
+                linear-gradient(90deg, rgba(59,130,246,0.03) 1px, transparent 1px);
+            background-size: 40px 40px; pointer-events: none;
         }
-        h1 { font-size: 26px; font-weight: 700; color: #1e1b4b; }
-        p  { color: #6b7280; margin: 6px 0 28px; font-size: 14px; }
-        input {
-            width: 100%; padding: 13px 16px; margin-bottom: 12px;
-            border: 1.5px solid #e5e7eb; border-radius: 12px;
-            font-size: 14px; transition: border-color 0.15s;
+        .card {
+            background: #111318; border: 1px solid #1e2330;
+            border-radius: 20px; padding: 44px 40px; width: 380px; position: relative;
         }
-        input:focus { outline: none; border-color: #6366f1; }
+        .card::before {
+            content: ''; position: absolute; top: 0; left: 40px; right: 40px; height: 2px;
+            background: linear-gradient(90deg, #3b82f6, #60a5fa, #a78bfa);
+            border-radius: 0 0 4px 4px;
+        }
+        .brand { display: flex; align-items: center; gap: 12px; margin-bottom: 32px; }
+        .brand-mark {
+            width: 40px; height: 40px; background: #3b82f6; border-radius: 10px;
+            display: flex; align-items: center; justify-content: center;
+            font-family: 'Geist Mono', monospace; font-weight: 500; font-size: 13px; color: #fff;
+        }
+        .brand-name { font-size: 18px; font-weight: 700; }
+        .brand-sub  { font-size: 11px; color: #4a5568; font-family: 'Geist Mono', monospace; letter-spacing: 0.08em; }
+        label { display: block; font-size: 11px; font-weight: 600; color: #8892a4; letter-spacing: 0.1em; margin-bottom: 7px; }
+        input[type="password"] {
+            width: 100%; padding: 11px 14px; background: #181c24;
+            border: 1px solid #262d3d; border-radius: 10px;
+            font-size: 14px; font-family: 'Geist Mono', monospace;
+            color: #e8ecf4; letter-spacing: 0.1em; margin-bottom: 20px;
+            transition: border-color 0.18s;
+        }
+        input[type="password"]:focus { outline: none; border-color: #3b82f6; }
         button {
-            width: 100%; padding: 13px;
-            background: #6366f1; color: white;
-            border: none; border-radius: 12px;
-            font-size: 15px; font-weight: 600;
-            cursor: pointer; transition: background 0.15s;
+            width: 100%; padding: 12px; background: #3b82f6; color: #fff;
+            border: none; border-radius: 10px; font-size: 14px; font-weight: 600;
+            font-family: 'Syne', sans-serif; cursor: pointer; transition: background 0.18s;
+        }
+        button:hover { background: #2563eb; }
+        .error {
+            color: #ef4444; font-size: 12px; margin-bottom: 14px;
+            padding: 9px 12px; background: rgba(239,68,68,0.08);
+            border: 1px solid rgba(239,68,68,0.2); border-radius: 8px;
         }
-        button:hover { background: #4f46e5; }
-        .error { color: #ef4444; font-size: 13px; margin-bottom: 12px; }
     </style>
 </head>
 <body>
-    <div class="login-card">
-        <h1>Navitrends</h1>
-        <p>Management Platform</p>
-        {% if error %}<div class="error">⚠️ {{ error }}</div>{% endif %}
+    <div class="card">
+        <div class="brand">
+            <div class="brand-mark">NV</div>
+            <div>
+                <div class="brand-name">Navitrends</div>
+                <div class="brand-sub">OPS PLATFORM</div>
+            </div>
+        </div>
+        {% if error %}<div class="error">⚠ {{ error }}</div>{% endif %}
         <form method="post">
-            <input type="password" name="password" placeholder="Enter password" required autofocus>
-            <button type="submit">Login →</button>
+            <label>ACCESS PASSWORD</label>
+            <input type="password" name="password" placeholder="••••••••••" required autofocus>
+            <button type="submit">Sign In →</button>
         </form>
     </div>
 </body>