fix: rename migration 0039_app_settings to 0041 to avoid conflict with 0039_cash-rounding

- use-pagination.ts: ts-expect-error on navigate call — search type resolves as never without route context, safe with strict:false
- $enrollmentId.tsx: wrap onValueChange to cast string to billingUnit union type

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Dockerfile.devpod

@@ -8,8 +8,8 @@ ENV PATH="/usr/local/bin:/root/.bun/bin:$PATH"
 RUN apt-get update && apt-get install -y --no-install-recommends \
     curl wget git openssh-server ca-certificates gnupg \
     build-essential unzip zip jq tmux zsh ripgrep \
-    postgresql-client redis-tools haproxy \
+    postgresql-client redis-tools haproxy tini \
-    nano vim htop netcat-openbsd dnsutils iputils-ping \
+    nano vim htop netcat-openbsd dnsutils iputils-ping lsof iproute2 \
     && rm -rf /var/lib/apt/lists/*
 
 # Bun — install then move to /usr/local/bin so it's on the image filesystem, not the /root PVC
@@ -44,4 +44,4 @@ RUN chmod +x /entrypoint.sh
 
 WORKDIR /root
 EXPOSE 8080 22
-ENTRYPOINT ["/entrypoint.sh"]
+ENTRYPOINT ["/usr/bin/tini", "--", "/entrypoint.sh"]

chart/templates/backend-deployment.yaml

@@ -73,6 +73,50 @@ spec:
                 secretKeyRef:
                   name: lunarfront-secrets
                   key: jwt-secret
+            - name: ENCRYPTION_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: lunarfront-secrets
+                  key: encryption-key
+            - name: RESEND_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: lunarfront-secrets
+                  key: resend-api-key
+            - name: MAIL_FROM
+              valueFrom:
+                secretKeyRef:
+                  name: lunarfront-secrets
+                  key: mail-from
+            - name: BUSINESS_NAME
+              valueFrom:
+                secretKeyRef:
+                  name: lunarfront-secrets
+                  key: business-name
+            - name: INITIAL_USER_EMAIL
+              valueFrom:
+                secretKeyRef:
+                  name: lunarfront-secrets
+                  key: initial-user-email
+                  optional: true
+            - name: INITIAL_USER_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: lunarfront-secrets
+                  key: initial-user-password
+                  optional: true
+            - name: INITIAL_USER_FIRST_NAME
+              valueFrom:
+                secretKeyRef:
+                  name: lunarfront-secrets
+                  key: initial-user-first-name
+                  optional: true
+            - name: INITIAL_USER_LAST_NAME
+              valueFrom:
+                secretKeyRef:
+                  name: lunarfront-secrets
+                  key: initial-user-last-name
+                  optional: true
           livenessProbe:
             httpGet:
               path: /v1/health

packages/admin/src/hooks/use-pagination.ts

@@ -23,12 +23,13 @@ export function usePagination() {
 
   function setParams(updates: Partial<PaginationSearch>) {
     navigate({
-      search: ((prev: Record<string, unknown>) => ({
+      // @ts-expect-error: navigate without a route context resolves search as never; safe here since we use strict:false
+      search: (prev: any) => ({
         ...prev,
         ...updates,
         // Reset to page 1 when search or sort changes
         page: updates.q !== undefined || updates.sort !== undefined ? 1 : (updates.page ?? (prev as PaginationSearch).page),
-      })) as (prev: Record<string, unknown>) => Record<string, unknown>,
+      }),
       replace: true,
     })
   }

packages/admin/src/routes/_authenticated.tsx

@@ -67,7 +67,7 @@ function NavLink({ to, icon, label, collapsed }: { to: string; icon: React.React
   return (
     <Link
       to={to as '/accounts'}
-      search={{} as Record<string, unknown>}
+      search={{ page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const }}
       className="flex items-center gap-2 px-3 py-2 rounded-md text-sm text-sidebar-foreground hover:bg-sidebar-accent"
       activeProps={{ className: 'flex items-center gap-2 px-3 py-2 rounded-md text-sm bg-sidebar-accent text-sidebar-accent-foreground' }}
       title={collapsed ? label : undefined}

packages/admin/src/routes/_authenticated/accounts/$accountId/enrollments.tsx

@@ -41,7 +41,7 @@ function AccountEnrollmentsTab() {
       <div className="flex items-center justify-between">
         <p className="text-sm text-muted-foreground">{data?.pagination.total ?? 0} enrollment(s)</p>
         {hasPermission('lessons.edit') && (
-          <Button size="sm" onClick={() => navigate({ to: '/lessons/enrollments/new', search: {} as Record<string, unknown> })}>
+          <Button size="sm" onClick={() => navigate({ to: '/lessons/enrollments/new', search: { memberId: undefined, accountId: undefined } })}>
             <Plus className="h-4 w-4 mr-1" />Enroll a Member
           </Button>
         )}
@@ -55,7 +55,7 @@ function AccountEnrollmentsTab() {
         total={data?.data?.length ?? 0}
         onPageChange={() => {}}
         onSort={() => {}}
-        onRowClick={(e) => navigate({ to: '/lessons/enrollments/$enrollmentId', params: { enrollmentId: e.id }, search: {} as Record<string, unknown> })}
+        onRowClick={(e) => navigate({ to: '/lessons/enrollments/$enrollmentId', params: { enrollmentId: e.id }, search: { tab: 'details' } })}
       />
     </div>
   )

packages/admin/src/routes/_authenticated/accounts/$accountId/members.tsx

@@ -281,7 +281,7 @@ function MembersTab() {
                             <DropdownMenuItem onClick={() => navigate({
                               to: '/members/$memberId',
                               params: { memberId: m.id },
-                              search: {} as Record<string, unknown>,
+                              search: { tab: 'details' },
                             })}>
                               <Pencil className="mr-2 h-4 w-4" />
                               Edit

packages/admin/src/routes/_authenticated/index.tsx

@@ -2,6 +2,6 @@ import { createFileRoute, redirect } from '@tanstack/react-router'
 
 export const Route = createFileRoute('/_authenticated/')({
   beforeLoad: () => {
-    throw redirect({ to: '/accounts', search: {} as Record<string, unknown> })
+    throw redirect({ to: '/accounts', search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const } })
   },
 })

packages/admin/src/routes/_authenticated/inventory/$productId.tsx

@@ -159,7 +159,7 @@ function ProductDetailPage() {
   })
 
   function setTab(t: string) {
-    navigate({ to: '/inventory/$productId', params: { productId }, search: { tab: t } as Record<string, unknown> })
+    navigate({ to: '/inventory/$productId', params: { productId }, search: { tab: t } })
   }
 
   function handleQtySave() {
@@ -192,7 +192,7 @@ function ProductDetailPage() {
     <div className="space-y-6">
       {/* Header */}
       <div className="flex items-center gap-3">
-        <Button variant="ghost" size="sm" onClick={() => navigate({ to: '/inventory', search: {} as Record<string, unknown> })}>
+        <Button variant="ghost" size="sm" onClick={() => navigate({ to: '/inventory', search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const, categoryId: undefined, isActive: undefined, type: undefined, lowStock: undefined } })}>
           <ArrowLeft className="h-4 w-4" />
         </Button>
         <div className="min-w-0">

packages/admin/src/routes/_authenticated/inventory/index.tsx

@@ -71,7 +71,7 @@ function InventoryPage() {
       queryClient.invalidateQueries({ queryKey: productKeys.all })
       toast.success('Product created')
       setCreateOpen(false)
-      navigate({ to: '/inventory/$productId', params: { productId: product.id }, search: {} as Record<string, unknown> })
+      navigate({ to: '/inventory/$productId', params: { productId: product.id }, search: { tab: 'details' } })
     },
     onError: (err) => toast.error(err.message),
   })
@@ -83,23 +83,23 @@ function InventoryPage() {
 
   function handleCategoryChange(v: string) {
     setCategoryFilter(v === 'all' ? '' : v)
-    navigate({ to: '/inventory', search: { ...search, categoryId: v === 'all' ? undefined : v, page: 1 } as Record<string, unknown> })
+    navigate({ to: '/inventory', search: { ...search, categoryId: v === 'all' ? undefined : v, page: 1 } })
   }
 
   function handleActiveChange(v: string) {
     setActiveFilter(v === 'all' ? '' : v)
-    navigate({ to: '/inventory', search: { ...search, isActive: v === 'all' ? undefined : v, page: 1 } as Record<string, unknown> })
+    navigate({ to: '/inventory', search: { ...search, isActive: v === 'all' ? undefined : v, page: 1 } })
   }
 
   function handleTypeChange(v: string) {
     setTypeFilter(v === 'all' ? '' : v)
-    navigate({ to: '/inventory', search: { ...search, type: v === 'all' ? undefined : v, page: 1 } as Record<string, unknown> })
+    navigate({ to: '/inventory', search: { ...search, type: v === 'all' ? undefined : v, page: 1 } })
   }
 
   function handleLowStockChange(v: string) {
     const on = v === 'true'
     setLowStockFilter(on)
-    navigate({ to: '/inventory', search: { ...search, lowStock: on ? 'true' : undefined, page: 1 } as Record<string, unknown> })
+    navigate({ to: '/inventory', search: { ...search, lowStock: on ? 'true' : undefined, page: 1 } })
   }
 
   const columns: Column<Product>[] = [
@@ -246,7 +246,7 @@ function InventoryPage() {
         order={params.order}
         onPageChange={setPage}
         onSort={setSort}
-        onRowClick={(p) => navigate({ to: '/inventory/$productId', params: { productId: p.id }, search: {} as Record<string, unknown> })}
+        onRowClick={(p) => navigate({ to: '/inventory/$productId', params: { productId: p.id }, search: { tab: 'details' } })}
       />
     </div>
   )

packages/admin/src/routes/_authenticated/lessons/enrollments/$enrollmentId.tsx

@@ -81,7 +81,7 @@ function EnrollmentDetailPage() {
   const tab = search.tab
 
   function setTab(t: string) {
-    navigate({ to: '/lessons/enrollments/$enrollmentId', params: { enrollmentId }, search: { tab: t } as Record<string, unknown> })
+    navigate({ to: '/lessons/enrollments/$enrollmentId', params: { enrollmentId }, search: { tab: t } })
   }
 
   const { data: enrollment, isLoading } = useQuery(enrollmentDetailOptions(enrollmentId))
@@ -131,7 +131,7 @@ function EnrollmentDetailPage() {
   return (
     <div className="space-y-6">
       <div className="flex items-center gap-4">
-        <Button variant="ghost" size="sm" onClick={() => navigate({ to: '/lessons/enrollments', search: {} as Record<string, unknown> })}>
+        <Button variant="ghost" size="sm" onClick={() => navigate({ to: '/lessons/enrollments', search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'desc' as const, status: undefined, instructorId: undefined } })}>
           <ArrowLeft className="h-4 w-4 mr-1" />Back
         </Button>
         <div className="flex-1">
@@ -265,7 +265,7 @@ function DetailsTab({
                   onChange={(e) => setBillingInterval(e.target.value)}
                   className="w-20"
                 />
-                <Select value={billingUnit} onValueChange={setBillingUnit}>
+                <Select value={billingUnit} onValueChange={(v) => setBillingUnit(v as typeof billingUnit)}>
                   <SelectTrigger className="w-36"><SelectValue /></SelectTrigger>
                   <SelectContent>
                     {BILLING_UNITS.map((u) => (
@@ -344,7 +344,7 @@ function SessionsTab({ enrollmentId, onGenerate, generating }: { enrollmentId: s
         total={data?.data?.length ?? 0}
         onPageChange={() => {}}
         onSort={() => {}}
-        onRowClick={(s) => navigate({ to: '/lessons/sessions/$sessionId', params: { sessionId: s.id }, search: {} as Record<string, unknown> })}
+        onRowClick={(s) => navigate({ to: '/lessons/sessions/$sessionId', params: { sessionId: s.id }, search: {} })}
       />
     </div>
   )
@@ -383,7 +383,7 @@ function LessonPlanTab({ enrollmentId, memberId, canEdit }: { enrollmentId: stri
       queryClient.invalidateQueries({ queryKey: lessonPlanKeys.all })
       toast.success('Plan created from template')
       setTemplatePickerOpen(false)
-      navigate({ to: '/lessons/plans/$planId', params: { planId: plan.id }, search: {} as Record<string, unknown> })
+      navigate({ to: '/lessons/plans/$planId', params: { planId: plan.id }, search: {} })
     },
     onError: (err) => toast.error(err.message),
   })
@@ -401,7 +401,7 @@ function LessonPlanTab({ enrollmentId, memberId, canEdit }: { enrollmentId: stri
                 {Math.round(activePlan.progress)}% complete
               </p>
             </div>
-            <Button variant="outline" size="sm" onClick={() => navigate({ to: '/lessons/plans/$planId', params: { planId: activePlan.id }, search: {} as Record<string, unknown> })}>
+            <Button variant="outline" size="sm" onClick={() => navigate({ to: '/lessons/plans/$planId', params: { planId: activePlan.id }, search: {} })}>
               View Plan
             </Button>
           </div>

packages/admin/src/routes/_authenticated/lessons/enrollments/index.tsx

@@ -72,7 +72,7 @@ function EnrollmentsListPage() {
   function handleStatusChange(v: string) {
     const s = v === 'all' ? '' : v
     setStatusFilter(s)
-    navigate({ to: '/lessons/enrollments', search: { ...search, status: s || undefined, page: 1 } as Record<string, unknown> })
+    navigate({ to: '/lessons/enrollments', search: { ...search, status: s || undefined, page: 1 } })
   }
 
   return (
@@ -80,7 +80,7 @@ function EnrollmentsListPage() {
       <div className="flex items-center justify-between">
         <h1 className="text-2xl font-bold">Enrollments</h1>
         {hasPermission('lessons.edit') && (
-          <Button onClick={() => navigate({ to: '/lessons/enrollments/new', search: {} as Record<string, unknown> })}>
+          <Button onClick={() => navigate({ to: '/lessons/enrollments/new', search: { memberId: undefined, accountId: undefined } })}>
             <Plus className="mr-2 h-4 w-4" />New Enrollment
           </Button>
         )}
@@ -125,7 +125,7 @@ function EnrollmentsListPage() {
         order={params.order}
         onPageChange={setPage}
         onSort={setSort}
-        onRowClick={(e) => navigate({ to: '/lessons/enrollments/$enrollmentId', params: { enrollmentId: e.id }, search: {} as Record<string, unknown> })}
+        onRowClick={(e) => navigate({ to: '/lessons/enrollments/$enrollmentId', params: { enrollmentId: e.id }, search: { tab: 'details' } })}
       />
     </div>
   )

packages/admin/src/routes/_authenticated/lessons/enrollments/new.tsx

@@ -108,7 +108,7 @@ function NewEnrollmentPage() {
     },
     onSuccess: (enrollment) => {
       toast.success('Enrollment created')
-      navigate({ to: '/lessons/enrollments/$enrollmentId', params: { enrollmentId: enrollment.id }, search: {} as Record<string, unknown> })
+      navigate({ to: '/lessons/enrollments/$enrollmentId', params: { enrollmentId: enrollment.id }, search: { tab: 'details' } })
     },
     onError: (err) => toast.error(err.message),
   })
@@ -141,7 +141,7 @@ function NewEnrollmentPage() {
   return (
     <div className="space-y-6 max-w-2xl">
       <div className="flex items-center gap-3">
-        <Button variant="ghost" size="sm" onClick={() => navigate({ to: '/lessons/enrollments', search: {} as Record<string, unknown> })}>
+        <Button variant="ghost" size="sm" onClick={() => navigate({ to: '/lessons/enrollments', search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'desc' as const, status: undefined, instructorId: undefined } })}>
           <ArrowLeft className="h-4 w-4" />
         </Button>
         <h1 className="text-2xl font-bold">New Enrollment</h1>
@@ -282,7 +282,7 @@ function NewEnrollmentPage() {
           <Button type="submit" disabled={mutation.isPending || !selectedMember || !selectedSlotId || !startDate} size="lg">
             {mutation.isPending ? 'Creating...' : 'Create Enrollment'}
           </Button>
-          <Button variant="secondary" type="button" size="lg" onClick={() => navigate({ to: '/lessons/enrollments', search: {} as Record<string, unknown> })}>
+          <Button variant="secondary" type="button" size="lg" onClick={() => navigate({ to: '/lessons/enrollments', search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'desc' as const, status: undefined, instructorId: undefined } })}>
             Cancel
           </Button>
         </div>

packages/admin/src/routes/_authenticated/lessons/plans/$planId.tsx

@@ -93,7 +93,7 @@ function LessonPlanDetailPage() {
   return (
     <div className="space-y-6 max-w-3xl">
       <div className="flex items-center gap-3">
-        <Button variant="ghost" size="sm" onClick={() => navigate({ to: '/lessons/plans', search: {} as Record<string, unknown> })}>
+        <Button variant="ghost" size="sm" onClick={() => navigate({ to: '/lessons/plans', search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const } })}>
           <ArrowLeft className="h-4 w-4" />
         </Button>
         <div className="flex-1">

packages/admin/src/routes/_authenticated/lessons/plans/index.tsx

@@ -84,7 +84,7 @@ function LessonPlansPage() {
         order={params.order}
         onPageChange={setPage}
         onSort={setSort}
-        onRowClick={(p) => navigate({ to: '/lessons/plans/$planId', params: { planId: p.id }, search: {} as Record<string, unknown> })}
+        onRowClick={(p) => navigate({ to: '/lessons/plans/$planId', params: { planId: p.id }, search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const } })}
       />
     </div>
   )

packages/admin/src/routes/_authenticated/lessons/schedule/index.tsx

@@ -49,7 +49,7 @@ function ScheduleHubPage() {
   const canAdmin = hasPermission('lessons.admin')
 
   function setTab(t: string) {
-    navigate({ to: '/lessons/schedule', search: { ...search, tab: t, page: 1 } as Record<string, unknown> })
+    navigate({ to: '/lessons/schedule', search: { ...search, tab: t, page: 1 } })
   }
 
   return (
@@ -152,7 +152,7 @@ function InstructorsTab({ canAdmin, search: _search }: { canAdmin: boolean; sear
         order={params.order}
         onPageChange={setPage}
         onSort={setSort}
-        onRowClick={(i) => navigate({ to: '/lessons/schedule/instructors/$instructorId', params: { instructorId: i.id }, search: {} as Record<string, unknown> })}
+        onRowClick={(i) => navigate({ to: '/lessons/schedule/instructors/$instructorId', params: { instructorId: i.id }, search: { tab: 'overview' } })}
       />
     </div>
   )

packages/admin/src/routes/_authenticated/lessons/schedule/instructors/$instructorId.tsx

@@ -42,7 +42,7 @@ function InstructorDetailPage() {
   const tab = search.tab
 
   function setTab(t: string) {
-    navigate({ to: '/lessons/schedule/instructors/$instructorId', params: { instructorId }, search: { tab: t } as Record<string, unknown> })
+    navigate({ to: '/lessons/schedule/instructors/$instructorId', params: { instructorId }, search: { tab: t } })
   }
 
   const { data: instructor, isLoading } = useQuery(instructorDetailOptions(instructorId))
@@ -62,7 +62,7 @@ function InstructorDetailPage() {
   return (
     <div className="space-y-6">
       <div className="flex items-center gap-4">
-        <Button variant="ghost" size="sm" onClick={() => navigate({ to: '/lessons/schedule', search: { tab: 'instructors' } as Record<string, unknown> })}>
+        <Button variant="ghost" size="sm" onClick={() => navigate({ to: '/lessons/schedule', search: { tab: 'instructors', page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const } })}>
           <ArrowLeft className="h-4 w-4 mr-1" />Back
         </Button>
         <div className="flex-1">

packages/admin/src/routes/_authenticated/lessons/sessions/$sessionId.tsx

@@ -126,7 +126,7 @@ function SessionDetailPage() {
   return (
     <div className="space-y-6 max-w-3xl">
       <div className="flex items-center gap-3">
-        <Button variant="ghost" size="sm" onClick={() => navigate({ to: '/lessons/sessions', search: {} as Record<string, unknown> })}>
+        <Button variant="ghost" size="sm" onClick={() => navigate({ to: '/lessons/sessions', search: { view: 'list' as const, page: 1, limit: 25, q: undefined, sort: undefined, order: 'desc' as const, status: undefined, instructorId: undefined } })}>
           <ArrowLeft className="h-4 w-4" />
         </Button>
         <div className="flex-1">
@@ -137,7 +137,7 @@ function SessionDetailPage() {
             <Link
               to="/lessons/enrollments/$enrollmentId"
               params={{ enrollmentId: enrollment.id }}
-              search={{} as Record<string, unknown>}
+              search={{ tab: 'details' }}
               className="text-sm text-primary hover:underline"
             >
               View Enrollment

packages/admin/src/routes/_authenticated/lessons/sessions/index.tsx

@@ -92,13 +92,13 @@ function SessionsPage() {
   const weekEnd = endOfWeek(weekStart, { weekStartsOn: 0 })
 
   function setView(v: 'list' | 'week') {
-    navigate({ to: '/lessons/sessions', search: { ...search, view: v, page: 1 } as Record<string, unknown> })
+    navigate({ to: '/lessons/sessions', search: { ...search, view: v, page: 1 } })
   }
 
   function handleStatusChange(v: string) {
     const s = v === 'all' ? '' : v
     setStatusFilter(s)
-    navigate({ to: '/lessons/sessions', search: { ...search, status: s || undefined, page: 1 } as Record<string, unknown> })
+    navigate({ to: '/lessons/sessions', search: { ...search, status: s || undefined, page: 1 } })
   }
 
   // List query
@@ -189,7 +189,7 @@ function SessionsPage() {
             order={params.order}
             onPageChange={setPage}
             onSort={setSort}
-            onRowClick={(s) => navigate({ to: '/lessons/sessions/$sessionId', params: { sessionId: s.id }, search: {} as Record<string, unknown> })}
+            onRowClick={(s) => navigate({ to: '/lessons/sessions/$sessionId', params: { sessionId: s.id }, search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const } })}
           />
         </>
       )}
@@ -249,7 +249,7 @@ function SessionsPage() {
                   {daySessions.map((s) => (
                     <button
                       key={s.id}
-                      onClick={() => navigate({ to: '/lessons/sessions/$sessionId', params: { sessionId: s.id }, search: {} as Record<string, unknown> })}
+                      onClick={() => navigate({ to: '/lessons/sessions/$sessionId', params: { sessionId: s.id }, search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const } })}
                       className={`w-full text-left rounded border px-1.5 py-1 text-xs hover:opacity-80 transition-opacity ${STATUS_COLORS[s.status] ?? STATUS_COLORS.scheduled}`}
                     >
                       <p className="font-semibold">{formatTime(s.scheduledTime)}</p>

packages/admin/src/routes/_authenticated/lessons/templates/$templateId.tsx

@@ -42,7 +42,7 @@ function TemplateDetailPage() {
   return (
     <div className="space-y-6 max-w-3xl">
       <div className="flex items-center gap-3">
-        <Button variant="ghost" size="sm" onClick={() => navigate({ to: '/lessons/templates', search: {} as Record<string, unknown> })}>
+        <Button variant="ghost" size="sm" onClick={() => navigate({ to: '/lessons/templates', search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const } })}>
           <ArrowLeft className="h-4 w-4" />
         </Button>
         <div className="flex-1">
@@ -218,7 +218,7 @@ function InstantiateDialog({ template, templateId, open, onClose }: {
       }),
     onSuccess: (plan) => {
       toast.success('Plan created from template')
-      navigate({ to: '/lessons/plans/$planId', params: { planId: plan.id }, search: {} as Record<string, unknown> })
+      navigate({ to: '/lessons/plans/$planId', params: { planId: plan.id }, search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const } })
     },
     onError: (err) => toast.error(err.message),
   })

packages/admin/src/routes/_authenticated/lessons/templates/index.tsx

@@ -96,7 +96,7 @@ function TemplatesListPage() {
       <div className="flex items-center justify-between">
         <h1 className="text-2xl font-bold">Lesson Plan Templates</h1>
         {canAdmin && (
-          <Button onClick={() => navigate({ to: '/lessons/templates/new', search: {} as Record<string, unknown> })}>
+          <Button onClick={() => navigate({ to: '/lessons/templates/new', search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const } })}>
             <Plus className="mr-2 h-4 w-4" />New Template
           </Button>
         )}
@@ -126,7 +126,7 @@ function TemplatesListPage() {
         order={params.order}
         onPageChange={setPage}
         onSort={setSort}
-        onRowClick={(t) => navigate({ to: '/lessons/templates/$templateId', params: { templateId: t.id }, search: {} as Record<string, unknown> })}
+        onRowClick={(t) => navigate({ to: '/lessons/templates/$templateId', params: { templateId: t.id }, search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const } })}
       />
     </div>
   )

packages/admin/src/routes/_authenticated/lessons/templates/new.tsx

@@ -45,7 +45,7 @@ function NewTemplatePage() {
       }),
     onSuccess: (template) => {
       toast.success('Template created')
-      navigate({ to: '/lessons/templates/$templateId', params: { templateId: template.id }, search: {} as Record<string, unknown> })
+      navigate({ to: '/lessons/templates/$templateId', params: { templateId: template.id }, search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const } })
     },
     onError: (err) => toast.error(err.message),
   })
@@ -63,7 +63,7 @@ function NewTemplatePage() {
   return (
     <form onSubmit={handleSubmit} className="space-y-6 max-w-3xl">
       <div className="flex items-center gap-3">
-        <Button type="button" variant="ghost" size="sm" onClick={() => navigate({ to: '/lessons/templates', search: {} as Record<string, unknown> })}>
+        <Button type="button" variant="ghost" size="sm" onClick={() => navigate({ to: '/lessons/templates', search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const } })}>
           <ArrowLeft className="h-4 w-4" />
         </Button>
         <h1 className="text-2xl font-bold">New Template</h1>
@@ -112,7 +112,7 @@ function NewTemplatePage() {
         <Button type="submit" disabled={mutation.isPending || !name.trim() || !allSectionsValid} size="lg">
           {mutation.isPending ? 'Creating...' : 'Create Template'}
         </Button>
-        <Button type="button" variant="secondary" size="lg" onClick={() => navigate({ to: '/lessons/templates', search: {} as Record<string, unknown> })}>
+        <Button type="button" variant="secondary" size="lg" onClick={() => navigate({ to: '/lessons/templates', search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const } })}>
           Cancel
         </Button>
       </div>

packages/admin/src/routes/_authenticated/members/$memberId.tsx

@@ -161,7 +161,7 @@ function MemberDetailPage() {
   })
 
   function setTab(t: string) {
-    navigate({ to: '/members/$memberId', params: { memberId }, search: { tab: t } as Record<string, unknown> })
+    navigate({ to: '/members/$memberId', params: { memberId }, search: { tab: t } })
   }
 
   if (isLoading) {
@@ -188,7 +188,7 @@ function MemberDetailPage() {
     <div className="space-y-6">
       {/* Header */}
       <div className="flex items-center gap-3">
-        <Button variant="ghost" size="sm" onClick={() => navigate({ to: '/accounts/$accountId/members', params: { accountId: member.accountId }, search: {} as Record<string, unknown> })}>
+        <Button variant="ghost" size="sm" onClick={() => navigate({ to: '/accounts/$accountId/members', params: { accountId: member.accountId }, search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const } })}>
           <ArrowLeft className="h-4 w-4" />
         </Button>
         <div>
@@ -293,7 +293,7 @@ function MemberDetailPage() {
           <div className="flex items-center justify-between">
             <p className="text-sm text-muted-foreground">{enrollmentsData?.pagination.total ?? 0} enrollment(s)</p>
             {hasPermission('lessons.edit') && (
-              <Button size="sm" onClick={() => navigate({ to: '/lessons/enrollments/new', search: { memberId } as Record<string, unknown> })}>
+              <Button size="sm" onClick={() => navigate({ to: '/lessons/enrollments/new', search: { memberId, accountId: undefined } })}>
                 <Plus className="h-4 w-4 mr-1" />Enroll
               </Button>
             )}
@@ -307,7 +307,7 @@ function MemberDetailPage() {
             total={enrollmentsData?.data?.length ?? 0}
             onPageChange={() => {}}
             onSort={() => {}}
-            onRowClick={(e) => navigate({ to: '/lessons/enrollments/$enrollmentId', params: { enrollmentId: e.id }, search: {} as Record<string, unknown> })}
+            onRowClick={(e) => navigate({ to: '/lessons/enrollments/$enrollmentId', params: { enrollmentId: e.id }, search: { tab: 'details' } })}
           />
         </div>
       )}

packages/admin/src/routes/_authenticated/members/index.tsx

@@ -84,7 +84,7 @@ function MembersListPage() {
             </Button>
           </DropdownMenuTrigger>
           <DropdownMenuContent align="end">
-            <DropdownMenuItem onClick={() => navigate({ to: '/members/$memberId', params: { memberId: row.id }, search: {} as Record<string, unknown> })}>
+            <DropdownMenuItem onClick={() => navigate({ to: '/members/$memberId', params: { memberId: row.id }, search: { tab: 'details' } })}>
               <Pencil className="mr-2 h-4 w-4" />
               Edit
             </DropdownMenuItem>
@@ -134,7 +134,7 @@ function MembersListPage() {
         order={params.order}
         onPageChange={setPage}
         onSort={setSort}
-        onRowClick={(member) => navigate({ to: '/members/$memberId', params: { memberId: member.id }, search: {} as Record<string, unknown> })}
+        onRowClick={(member) => navigate({ to: '/members/$memberId', params: { memberId: member.id }, search: { tab: 'details' } })}
       />
     </div>
   )

packages/admin/src/routes/_authenticated/repair-batches/$batchId.tsx

@@ -96,12 +96,12 @@ function RepairBatchDetailPage() {
   const totalActual = tickets.reduce((sum, t) => sum + (t.actualCost ? parseFloat(t.actualCost) : 0), 0)
 
   function handleTicketClick(ticket: RepairTicket) {
-    navigate({ to: '/repairs/$ticketId', params: { ticketId: ticket.id }, search: {} as Record<string, unknown> })
+    navigate({ to: '/repairs/$ticketId', params: { ticketId: ticket.id }, search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const } })
   }
 
   function handleAddRepair() {
     // Navigate to new repair with batch and account pre-linked
-    navigate({ to: '/repairs/new', search: { batchId, batchName: batch!.batchNumber ?? '', accountId: batch!.accountId, contactName: batch!.contactName ?? '' } as Record<string, unknown> })
+    navigate({ to: '/repairs/new', search: { batchId, batchName: batch!.batchNumber ?? '', accountId: batch!.accountId, contactName: batch!.contactName ?? '' } })
   }
 
   async function generateBatchPdf() {
@@ -233,7 +233,7 @@ function RepairBatchDetailPage() {
   return (
     <div className="space-y-6 max-w-5xl">
       <div className="flex items-center gap-3">
-        <Button variant="ghost" size="sm" onClick={() => navigate({ to: '/repair-batches', search: {} as Record<string, unknown> })}>
+        <Button variant="ghost" size="sm" onClick={() => navigate({ to: '/repair-batches', search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const } })}>
           <ArrowLeft className="h-4 w-4" />
         </Button>
         <div className="flex-1">

packages/admin/src/routes/_authenticated/repair-batches/index.tsx

@@ -75,7 +75,7 @@ function RepairBatchesListPage() {
   }
 
   function handleRowClick(batch: RepairBatch) {
-    navigate({ to: '/repair-batches/$batchId', params: { batchId: batch.id }, search: {} as Record<string, unknown> })
+    navigate({ to: '/repair-batches/$batchId', params: { batchId: batch.id }, search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const } })
   }
 
   return (

packages/admin/src/routes/_authenticated/repair-batches/new.tsx

@@ -50,7 +50,7 @@ function NewRepairBatchPage() {
     mutationFn: repairBatchMutations.create,
     onSuccess: (batch) => {
       toast.success('Repair batch created')
-      navigate({ to: '/repair-batches/$batchId', params: { batchId: batch.id }, search: {} as Record<string, unknown> })
+      navigate({ to: '/repair-batches/$batchId', params: { batchId: batch.id }, search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const } })
     },
     onError: (err) => toast.error(err.message),
   })
@@ -78,7 +78,7 @@ function NewRepairBatchPage() {
   return (
     <div className="space-y-6 max-w-3xl">
       <div className="flex items-center gap-3">
-        <Button variant="ghost" size="sm" onClick={() => navigate({ to: '/repair-batches', search: {} as Record<string, unknown> })}>
+        <Button variant="ghost" size="sm" onClick={() => navigate({ to: '/repair-batches', search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const } })}>
           <ArrowLeft className="h-4 w-4" />
         </Button>
         <h1 className="text-2xl font-bold">New Repair Batch</h1>
@@ -176,7 +176,7 @@ function NewRepairBatchPage() {
           <Button type="submit" disabled={mutation.isPending} size="lg">
             {mutation.isPending ? 'Creating...' : 'Create Batch'}
           </Button>
-          <Button variant="secondary" type="button" size="lg" onClick={() => navigate({ to: '/repair-batches', search: {} as Record<string, unknown> })}>
+          <Button variant="secondary" type="button" size="lg" onClick={() => navigate({ to: '/repair-batches', search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const } })}>
             Cancel
           </Button>
         </div>

packages/admin/src/routes/_authenticated/repairs/$ticketId.tsx

@@ -175,7 +175,7 @@ function RepairTicketDetailPage() {
     <div className="space-y-4 max-w-5xl">
       {/* Header */}
       <div className="flex items-center gap-3">
-        <Button variant="ghost" size="sm" onClick={() => navigate({ to: '/repairs', search: {} as Record<string, unknown> })}>
+        <Button variant="ghost" size="sm" onClick={() => navigate({ to: '/repairs', search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const } })}>
           <ArrowLeft className="h-4 w-4" />
         </Button>
         <div className="flex-1">

packages/admin/src/routes/_authenticated/repairs/index.tsx

@@ -129,7 +129,7 @@ function RepairsListPage() {
   }
 
   function handleRowClick(ticket: RepairTicket) {
-    navigate({ to: '/repairs/$ticketId', params: { ticketId: ticket.id }, search: {} as Record<string, unknown> })
+    navigate({ to: '/repairs/$ticketId', params: { ticketId: ticket.id }, search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const } })
   }
 
   return (
@@ -137,7 +137,7 @@ function RepairsListPage() {
       <div className="flex items-center justify-between">
         <h1 className="text-2xl font-bold">Repairs</h1>
         {hasPermission('repairs.edit') && (
-          <Button onClick={() => navigate({ to: '/repairs/new', search: {} as Record<string, unknown> })}>
+          <Button onClick={() => navigate({ to: '/repairs/new', search: { batchId: undefined, batchName: undefined, accountId: undefined, contactName: undefined } })}>
             <Plus className="mr-2 h-4 w-4" />
             New Repair
           </Button>

packages/admin/src/routes/_authenticated/repairs/new.tsx

@@ -136,7 +136,7 @@ function NewRepairPage() {
     },
     onSuccess: (ticket) => {
       toast.success('Repair ticket created')
-      navigate({ to: '/repairs/$ticketId', params: { ticketId: ticket.id }, search: {} as Record<string, unknown> })
+      navigate({ to: '/repairs/$ticketId', params: { ticketId: ticket.id }, search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const } })
     },
     onError: (err) => toast.error(err.message),
   })
@@ -210,7 +210,7 @@ function NewRepairPage() {
   return (
     <div className="space-y-6 max-w-4xl">
       <div className="flex items-center gap-3">
-        <Button variant="ghost" size="sm" onClick={() => navigate({ to: '/repairs', search: {} as Record<string, unknown> })}>
+        <Button variant="ghost" size="sm" onClick={() => navigate({ to: '/repairs', search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const } })}>
           <ArrowLeft className="h-4 w-4" />
         </Button>
         <h1 className="text-2xl font-bold">New Repair Ticket</h1>
@@ -486,7 +486,7 @@ function NewRepairPage() {
           <Button type="submit" disabled={mutation.isPending} size="lg">
             {mutation.isPending ? 'Creating...' : 'Create Ticket'}
           </Button>
-          <Button variant="secondary" type="button" size="lg" onClick={() => navigate({ to: '/repairs', search: {} as Record<string, unknown> })}>
+          <Button variant="secondary" type="button" size="lg" onClick={() => navigate({ to: '/repairs', search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const } })}>
             Cancel
           </Button>
         </div>

packages/admin/src/routes/_authenticated/roles/$roleId.tsx

@@ -100,7 +100,7 @@ function RoleDetailPage() {
   return (
     <div className="space-y-6 max-w-2xl">
       <div className="flex items-center gap-3">
-        <Button variant="ghost" size="sm" onClick={() => navigate({ to: '/roles', search: {} as Record<string, unknown> })}>
+        <Button variant="ghost" size="sm" onClick={() => navigate({ to: '/roles', search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const } })}>
           <ArrowLeft className="h-4 w-4" />
         </Button>
         <div>
@@ -177,7 +177,7 @@ function RoleDetailPage() {
         <Button onClick={handleSave} disabled={updateMutation.isPending}>
           {updateMutation.isPending ? 'Saving...' : 'Save Changes'}
         </Button>
-        <Button variant="secondary" onClick={() => navigate({ to: '/roles', search: {} as Record<string, unknown> })}>
+        <Button variant="secondary" onClick={() => navigate({ to: '/roles', search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const } })}>
           Cancel
         </Button>
       </div>

packages/admin/src/routes/_authenticated/roles/new.tsx

@@ -29,7 +29,7 @@ function NewRolePage() {
     onSuccess: () => {
       queryClient.invalidateQueries({ queryKey: rbacKeys.roles })
       toast.success('Role created')
-      navigate({ to: '/roles', search: {} as Record<string, unknown> })
+      navigate({ to: '/roles', search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const } })
     },
     onError: (err) => toast.error(err.message),
   })
@@ -153,7 +153,7 @@ function NewRolePage() {
         <Button onClick={handleSubmit} disabled={mutation.isPending}>
           {mutation.isPending ? 'Creating...' : 'Create Role'}
         </Button>
-        <Button variant="secondary" onClick={() => navigate({ to: '/roles', search: {} as Record<string, unknown> })}>
+        <Button variant="secondary" onClick={() => navigate({ to: '/roles', search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const } })}>
           Cancel
         </Button>
       </div>

packages/admin/src/routes/login.tsx

@@ -7,7 +7,7 @@ export const Route = createFileRoute('/login')({
   beforeLoad: () => {
     const { token } = useAuthStore.getState()
     if (token) {
-      throw redirect({ to: '/accounts', search: {} as Record<string, unknown> })
+      throw redirect({ to: '/accounts', search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const } })
     }
   },
   component: LoginPage,
@@ -30,7 +30,7 @@ function LoginPage() {
       const res = await login(email, password)
       setAuth(res.token, res.user)
       await router.invalidate()
-      await router.navigate({ to: '/accounts', search: {} as Record<string, unknown>, replace: true })
+      await router.navigate({ to: '/accounts', search: { page: 1, limit: 25, q: undefined, sort: undefined, order: 'asc' as const }, replace: true })
     } catch (err) {
       setError(err instanceof Error ? err.message : 'Login failed')
     } finally {

packages/backend/src/db/index.ts

@@ -3,3 +3,4 @@ export * from './schema/users.js'
 export * from './schema/accounts.js'
 export * from './schema/inventory.js'
 export * from './schema/pos.js'
+export * from './schema/settings.js'

packages/backend/src/db/migrations/0041_app_settings.sql

@@ -0,0 +1,8 @@
+CREATE TABLE IF NOT EXISTS "app_settings" (
+  "key" varchar(100) PRIMARY KEY,
+  "value" text,
+  "is_encrypted" boolean NOT NULL DEFAULT false,
+  "iv" text,
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  "updated_at" timestamptz NOT NULL DEFAULT now()
+);

packages/backend/src/db/migrations/meta/_journal.json

@@ -288,6 +288,13 @@
       "when": 1775494000000,
       "tag": "0040_app-config",
       "breakpoints": true
+    },
+    {
+      "idx": 41,
+      "version": "7",
+      "when": 1775580000000,
+      "tag": "0041_app_settings",
+      "breakpoints": true
     }
   ]
 }

packages/backend/src/db/schema/settings.ts

@@ -0,0 +1,13 @@
+import { pgTable, varchar, text, boolean, timestamp } from 'drizzle-orm/pg-core'
+
+export const appSettings = pgTable('app_settings', {
+  key: varchar('key', { length: 100 }).primaryKey(),
+  value: text('value'),
+  isEncrypted: boolean('is_encrypted').notNull().default(false),
+  iv: text('iv'),
+  createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().defaultNow(),
+})
+
+export type AppSetting = typeof appSettings.$inferSelect
+export type AppSettingInsert = typeof appSettings.$inferInsert

packages/backend/src/main.ts

@@ -34,6 +34,42 @@ import { configRoutes } from './routes/v1/config.js'
 import { RbacService } from './services/rbac.service.js'
 import { ModuleService } from './services/module.service.js'
 import { AppConfigService } from './services/config.service.js'
+import { SettingsService } from './services/settings.service.js'
+import { users } from './db/schema/users.js'
+import bcrypt from 'bcryptjs'
+
+async function seedInitialUser(app: Awaited<ReturnType<typeof buildApp>>) {
+  const email = process.env.INITIAL_USER_EMAIL
+  const password = process.env.INITIAL_USER_PASSWORD
+  const firstName = process.env.INITIAL_USER_FIRST_NAME
+  const lastName = process.env.INITIAL_USER_LAST_NAME
+  if (!email || !password || !firstName || !lastName) return
+
+  const existing = await app.db.select({ id: users.id }).from(users).limit(1)
+  if (existing.length > 0) return
+
+  const passwordHash = await bcrypt.hash(password, 10)
+  await app.db.insert(users).values({ email, passwordHash, firstName, lastName, role: 'admin' })
+  app.log.info({ email }, 'Initial admin user created')
+}
+
+async function seedEmailSettings(app: Awaited<ReturnType<typeof buildApp>>) {
+  const apiKey = process.env.RESEND_API_KEY
+  if (!apiKey) return
+
+  const existing = await SettingsService.get(app.db, 'email.provider')
+  if (existing) return
+
+  await SettingsService.set(app.db, 'email.provider', 'resend')
+  await SettingsService.set(app.db, 'email.resend_api_key', apiKey, true)
+  if (process.env.MAIL_FROM) {
+    await SettingsService.set(app.db, 'email.from_address', process.env.MAIL_FROM)
+  }
+  if (process.env.BUSINESS_NAME) {
+    await SettingsService.set(app.db, 'email.business_name', process.env.BUSINESS_NAME)
+  }
+  app.log.info('Email settings seeded from environment')
+}
 
 export async function buildApp() {
   const app = Fastify({
@@ -159,6 +195,16 @@ export async function buildApp() {
     } catch (err) {
       app.log.error({ err }, 'Failed to load app config')
     }
+    try {
+      await seedInitialUser(app)
+    } catch (err) {
+      app.log.error({ err }, 'Failed to seed initial user')
+    }
+    try {
+      await seedEmailSettings(app)
+    } catch (err) {
+      app.log.error({ err }, 'Failed to seed email settings')
+    }
   })
 
   return app

packages/backend/src/plugins/database.ts

@@ -6,8 +6,9 @@ import * as userSchema from '../db/schema/users.js'
 import * as accountSchema from '../db/schema/accounts.js'
 import * as inventorySchema from '../db/schema/inventory.js'
 import * as posSchema from '../db/schema/pos.js'
+import * as settingsSchema from '../db/schema/settings.js'
 
-const schema = { ...storeSchema, ...userSchema, ...accountSchema, ...inventorySchema, ...posSchema }
+const schema = { ...storeSchema, ...userSchema, ...accountSchema, ...inventorySchema, ...posSchema, ...settingsSchema }
 
 declare module 'fastify' {
   interface FastifyInstance {

packages/backend/src/services/email.service.ts

@@ -0,0 +1,106 @@
+import type { PostgresJsDatabase } from 'drizzle-orm/postgres-js'
+import { SettingsService } from './settings.service.js'
+
+interface SendOpts {
+  to: string
+  subject: string
+  html: string
+  text?: string
+}
+
+interface EmailProvider {
+  send(opts: SendOpts): Promise<void>
+}
+
+class ResendProvider implements EmailProvider {
+  constructor(private db: PostgresJsDatabase<any>) {}
+
+  async send(opts: SendOpts): Promise<void> {
+    const apiKey = await SettingsService.get(this.db, 'email.resend_api_key')
+      ?? process.env.RESEND_API_KEY
+    const from = await SettingsService.get(this.db, 'email.from_address')
+      ?? process.env.MAIL_FROM
+
+    if (!apiKey) throw new Error('Resend API key not configured')
+    if (!from) throw new Error('email.from_address not configured')
+
+    const res = await fetch('https://api.resend.com/emails', {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({
+        from,
+        to: opts.to,
+        subject: opts.subject,
+        html: opts.html,
+        ...(opts.text ? { text: opts.text } : {}),
+      }),
+    })
+
+    if (!res.ok) {
+      const body = await res.text()
+      throw new Error(`Resend API error ${res.status}: ${body}`)
+    }
+  }
+}
+
+class SendGridProvider implements EmailProvider {
+  constructor(private db: PostgresJsDatabase<any>) {}
+
+  async send(opts: SendOpts): Promise<void> {
+    const apiKey = await SettingsService.get(this.db, 'email.sendgrid_api_key')
+    const from = await SettingsService.get(this.db, 'email.from_address')
+      ?? process.env.MAIL_FROM
+
+    if (!apiKey) throw new Error('SendGrid API key not configured')
+    if (!from) throw new Error('email.from_address not configured')
+
+    const res = await fetch('https://api.sendgrid.com/v3/mail/send', {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({
+        personalizations: [{ to: [{ email: opts.to }] }],
+        from: { email: from },
+        subject: opts.subject,
+        content: [
+          { type: 'text/html', value: opts.html },
+          ...(opts.text ? [{ type: 'text/plain', value: opts.text }] : []),
+        ],
+      }),
+    })
+
+    if (!res.ok) {
+      const body = await res.text()
+      throw new Error(`SendGrid API error ${res.status}: ${body}`)
+    }
+  }
+}
+
+class SmtpProvider implements EmailProvider {
+  async send(_opts: SendOpts): Promise<void> {
+    throw new Error('SMTP email provider is not yet implemented')
+  }
+}
+
+export const EmailService = {
+  async send(db: PostgresJsDatabase<any>, opts: SendOpts): Promise<void> {
+    const provider = await SettingsService.get(db, 'email.provider')
+      ?? process.env.MAIL_PROVIDER
+
+    switch (provider) {
+      case 'resend':
+        return new ResendProvider(db).send(opts)
+      case 'sendgrid':
+        return new SendGridProvider(db).send(opts)
+      case 'smtp':
+        return new SmtpProvider().send(opts)
+      default:
+        throw new Error('Email provider not configured. Set email.provider in app_settings.')
+    }
+  },
+}

packages/backend/src/services/settings.service.ts

@@ -0,0 +1,41 @@
+import { eq } from 'drizzle-orm'
+import type { PostgresJsDatabase } from 'drizzle-orm/postgres-js'
+import { appSettings } from '../db/schema/settings.js'
+import { encrypt, decrypt } from '../utils/encryption.js'
+
+export const SettingsService = {
+  async get(db: PostgresJsDatabase<any>, key: string): Promise<string | null> {
+    const [row] = await db
+      .select()
+      .from(appSettings)
+      .where(eq(appSettings.key, key))
+      .limit(1)
+
+    if (!row || row.value === null) return null
+    if (row.isEncrypted && row.iv) return decrypt(row.value, row.iv)
+    return row.value
+  },
+
+  async set(db: PostgresJsDatabase<any>, key: string, value: string, encrypted = false): Promise<void> {
+    let storedValue = value
+    let iv: string | null = null
+
+    if (encrypted) {
+      const result = encrypt(value)
+      storedValue = result.ciphertext
+      iv = result.iv
+    }
+
+    await db
+      .insert(appSettings)
+      .values({ key, value: storedValue, isEncrypted: encrypted, iv, updatedAt: new Date() })
+      .onConflictDoUpdate({
+        target: appSettings.key,
+        set: { value: storedValue, isEncrypted: encrypted, iv, updatedAt: new Date() },
+      })
+  },
+
+  async delete(db: PostgresJsDatabase<any>, key: string): Promise<void> {
+    await db.delete(appSettings).where(eq(appSettings.key, key))
+  },
+}

packages/backend/src/utils/encryption.ts

@@ -0,0 +1,34 @@
+import { createCipheriv, createDecipheriv, randomBytes } from 'crypto'
+
+const ALGORITHM = 'aes-256-gcm'
+
+function getKey(): Buffer {
+  const hex = process.env.ENCRYPTION_KEY
+  if (!hex) throw new Error('ENCRYPTION_KEY env var is required for encrypted settings')
+  const key = Buffer.from(hex, 'hex')
+  if (key.length !== 32) throw new Error('ENCRYPTION_KEY must be a 64-character hex string (32 bytes)')
+  return key
+}
+
+export function encrypt(plaintext: string): { ciphertext: string; iv: string } {
+  const key = getKey()
+  const iv = randomBytes(12)
+  const cipher = createCipheriv(ALGORITHM, key, iv)
+  let encrypted = cipher.update(plaintext, 'utf8', 'hex')
+  encrypted += cipher.final('hex')
+  const authTag = cipher.getAuthTag().toString('hex')
+  return {
+    ciphertext: `${encrypted}:${authTag}`,
+    iv: iv.toString('hex'),
+  }
+}
+
+export function decrypt(ciphertext: string, iv: string): string {
+  const key = getKey()
+  const [encrypted, authTag] = ciphertext.split(':')
+  const decipher = createDecipheriv(ALGORITHM, key, Buffer.from(iv, 'hex'))
+  decipher.setAuthTag(Buffer.from(authTag, 'hex'))
+  let decrypted = decipher.update(encrypted, 'hex', 'utf8')
+  decrypted += decipher.final('utf8')
+  return decrypted
+}