feat: clarify spot card call to action

.gigacode/plans/1788956171115-stellar-wolf.plan.md

@@ -0,0 +1,51 @@
+# План работы RF4 Spotter — Регрессионный аудит
+
+На основе: [REGRESSION_AUDIT_2026-09-09.md](../docs/REGRESSION_AUDIT_2026-09-09.md)
+Дата: 2026-09-09
+
+## Выполнено
+
+### R01 ✅ — Caddy body_limit → request_body max_size
+- **Файл**: `deploy/Caddyfile`
+- **Проблема**: `body_limit 10M` не поддерживается в Caddy 2.10.2
+- **Решение**: `request_body { max_size 10M }`
+- **Верификация**: `caddy adapt` проходит без ошибок
+
+### R02 ✅ — Activity API contract regression
+- **API**: `main.py` — `/api/v1/activity` возвращает `PaginatedActivityOut`
+- **Frontend**: все 4 потребителя обновлены:
+  - `index.astro` ✅ (из предыдущего коммита)
+  - `fish/[slug].astro` ✅
+  - `waterbodies/[slug].astro` ✅
+  - `waterbodies/[slug]/[fish].astro` ✅
+  - `spots/[id].astro` ✅
+- **Тесты**: 4 теста обновлены под новый контракт
+- **Результат**: 76 passed, 1 skipped, 0 failures
+
+### R14 ✅ — Registry источников больше не зависит от БД при парсинге CLI
+- **Файл**: `community_scheduler.py`
+- **Решение**: `_static_registry()` — без БД; `configured_sources(enabled_keys)` — с опциональной БД
+- **Тесты**: scheduler unit-тесты проходят без PostgreSQL
+
+## Итоги тестов
+- **Python**: 76 passed, 1 skipped ✅
+- **Astro check**: 0 errors, 0 warnings, 0 hints ✅
+- **Caddy adapt**: passes ✅
+
+## Коммиты
+1. `a37f9c4` — R01 Caddy body_limit → request_body
+2. `d962ba2` — R02 activity API contract + R14 static registry
+
+## Осталось из регрессий (R03-R15)
+- R03: Research CLI cooldown broken (fcntl `r`/`r+` + encoding)
+- R04: Disabled-фильтрация обходит site cooldown
+- R05: Bootstrap небезопасен для источников
+- R06: Фильтры сигналов сравнивают slug с названием
+- R07: Ошибка главной остаётся HTTP 200
+- R08: Фильтры UI не доведены до responsive-состояния
+- R09: Пагинация (частично исправлено в U03)
+- R10: Ошибки формы теряют черновик
+- R11: Проверка URL после сетевого обращения
+- R12: Мониторинг не сигнализирует о зависшем импорте
+- R13: Доверие к IP клиента не ограничено proxy
+- R15: D04/D06/D07/D08 выполнены не полностью

.gitea/workflows/ci.yml

@@ -41,6 +41,8 @@ jobs:
           alembic current
       - name: Run Python tests
         run: pytest -q
+      - name: Verify generated OpenAPI contract
+        run: python apps/api/export_openapi.py --check
 
   astro-build:
     runs-on: ubuntu-latest

.gitignore

@@ -2,7 +2,6 @@ __pycache__/
 *.py[cod]
 .pytest_cache/
 .cache/
-data/media/files/
 .env.production
 .maintenance.lock
 .venv/

.idea/.gitignore

@@ -0,0 +1,5 @@
+# Default ignored files
+/shelf/
+/workspace.xml
+# Environment-dependent path to Maven home directory
+/mavenHomeManager.xml

.idea/gigaCode/agentSettings.xml

@@ -0,0 +1,266 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="GigaCodeAgentSettings">
+    <option name="autoApproveEdits" value="true" />
+    <option name="autoApprovedCommands">
+      <list>
+        <Execute>
+          <option name="pattern" value="mkdir -p /home/ik/git/rf4-help/.gigacode/plans" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="cd *" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="ls *" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="pip install *" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="tail *" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python pytest *" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python -c &quot;&#10;import ast&#10;import sys&#10;&#10;files = [&#10;    'apps/api/app/main.py',&#10;    'apps/api/app/readiness.py',&#10;    'apps/api/app/schemas.py',&#10;    'apps/api/app/activity.py',&#10;    'apps/api/app/community_scheduler.py',&#10;    'apps/api/app/community_importer.py',&#10;    'rf4_research/community_cli.py',&#10;]&#10;&#10;for f in files:&#10;    try:&#10;        with open(f) as fh:&#10;            ast.parse(fh.read())&#10;        print(f'OK: {f}')&#10;    except SyntaxError as e:&#10;        print(f'ERROR: {f}: {e}')&#10;        sys.exit(1)&#10;&#10;print('All Python files syntax OK')&#10;&quot;" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="npm run *" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="head *" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="npm install *" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="git add *" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="git reset *" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="git diff *" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="git log *" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="git commit *" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="git status" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="echo *" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="printf 'localhost {\n  body_limit 10M\n}\n' &gt; /tmp/test-caddyfile" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="cp /home/ik/git/rf4-help/deploy/Caddyfile /tmp/Caddyfile" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="printf 'example.com {\n  body_limit 10M\n}\n' &gt; /tmp/Caddyfile" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="printf 'example.com {\n  request_body {\n    max_size 10M\n  }\n}\n' &gt; /tmp/Caddyfile" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="docker run *" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="sed 's/email {$ACME_EMAIL}/email test@test.com/' /home/ik/git/rf4-help/deploy/Caddyfile &gt; /tmp/Caddyfile" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="grep *" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="printf 'example.com {\n  request_body {\n    max_size 10M\n  }\n  handle {\n    respond \&quot;ok\&quot;\n  }\n}\n' &gt; /tmp/Caddyfile" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python -c &quot;import ast; ast.parse(open('rf4_research/community_cli.py').read()); print('OK')&quot;" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python -c &quot;import ast; ast.parse(open('apps/api/app/community_scheduler.py').read()); print('OK')&quot;" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python -c &quot;import ast; ast.parse(open('apps/api/app/main.py').read()); print('OK')&quot;" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="node -e &quot;try { fetch('http://localhost:1', { signal: AbortSignal.timeout(100) }); } catch(e) { console.log(e.constructor.name, e.message); }&quot; 2&gt;&amp;1" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="node -e &quot;fetch('http://httpbin.org/delay/10', { signal: AbortSignal.timeout(200) }).catch(e =&gt; console.log(e.constructor.name, e.message));&quot; 2&gt;&amp;1" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="pip-compile requirements.txt --output-file requirements-lock.txt -q 2&gt;&amp;1" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="pip-compile requirements-dev.txt --output-file requirements-dev-lock.txt -q 2&gt;&amp;1" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="wc *" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="alembic revision *" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python -m app.cli --help 2&gt;&amp;1" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python -m rf4_research.community_cli --help 2&gt;&amp;1" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="alembic heads *" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 -c &quot;&#10;from urllib.request import Request, urlopen&#10;from urllib.error import HTTPError&#10;# Test with a URL that redirects&#10;try:&#10;    req = Request('https://httpbin.org/redirect/1', headers={'User-Agent': 'test'})&#10;    resp = urlopen(req, timeout=5)&#10;    print(f'Final URL: {resp.url}')&#10;    print(f'Response URL: {resp.url}')&#10;except Exception as e:&#10;    print(f'Error: {type(e).__name__}: {e}')&#10;&quot; 2&gt;&amp;1" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="pwd" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 -c &quot;from rf4_research import community_cli; print('Syntax OK')&quot;" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 /tmp/append_tests.py" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 pytest *" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 /tmp/fix_redirect_test.py" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 /tmp/fix_a04.py" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 /tmp/fix_a04_v2.py" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="git show *" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="git branch *" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 /tmp/test_double_reservation_bug.py" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 /tmp/fix_a02_double_reservation.py" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 /tmp/test_debug.py" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 /tmp/test_a02_final.py" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 /tmp/test_a02_v2.py" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 /tmp/test_a02_code.py" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 /tmp/fix_a04_pagination.py" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 /tmp/fix_a01_monitoring.py" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 /tmp/fix_a01_tests.py" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="*" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 /tmp/fix_a01_tests_v2.py" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 /tmp/fix_a04_filters.py" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 /tmp/fix_a05_sessionstorage.py" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 /tmp/fix_a06_tests.py" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 /tmp/fix_a07_review_note.py" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 /tmp/fix_a08_errorpage.py" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 /tmp/fix_a08_index.py" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 /tmp/fix_a11_pip_audit.py" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 /tmp/fix_a04_pagination_final.py" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 /tmp/fix_a08_index_unavailable.py" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 /tmp/fix_a08_spots.py" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 /tmp/fix_a08_records.py" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 /tmp/fix_a01_vars.py" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 /tmp/fix_a01_test.py" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 /tmp/fix_a07_auto_publish.py" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 /tmp/fix_a07_review_note_auto.py" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 /tmp/fix_a09_cli.py" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python3 -c &quot;from app.cli import main; import sys; sys.argv = ['cli', '--help']; main()&quot; 2&gt;&amp;1" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="find *" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="git push *" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python -c &quot;&#10;from sqlalchemy import create_engine, select&#10;from sqlalchemy.orm import Session&#10;from sqlalchemy.pool import StaticPool&#10;from app.database import Base&#10;from app.models import SubmissionAttempt&#10;import hashlib, hmac&#10;&#10;engine = create_engine('sqlite://', connect_args={'check_same_thread': False}, poolclass=StaticPool)&#10;Base.metadata.create_all(engine)&#10;&#10;with Session(engine) as db:&#10;    # Simulate first request&#10;    key = 'idem-test-key-001'&#10;    key_hash = hmac.new('change-rate-limit-secret'.encode(), key.encode(), hashlib.sha256).hexdigest()&#10;    print(f'Key hash: {key_hash}')&#10;    &#10;    # Check before storing&#10;    existing = db.scalar(select(SubmissionAttempt).where(SubmissionAttempt.idempotency_key == key_hash))&#10;    print(f'Found before: {existing}')&#10;    &#10;    # Store&#10;    from datetime import datetime, timezone&#10;    db.add(SubmissionAttempt(client_hash='test', idempotency_key=key_hash, created_at=datetime.now(timezone.utc)))&#10;    db.commit()&#10;    &#10;    # Check after storing&#10;    existing = db.scalar(select(SubmissionAttempt).where(SubmissionAttempt.idempotency_key == key_hash))&#10;    print(f'Found after: {existing}')&#10;    if existing:&#10;        print(f'  idempotency_key: {existing.idempotency_key}')&#10;&quot;" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python -c &quot;&#10;from sqlalchemy import create_engine, select&#10;from sqlalchemy.orm import Session&#10;from sqlalchemy.pool import StaticPool&#10;from app.database import Base&#10;from app.models import SubmissionAttempt&#10;import hashlib, hmac&#10;&#10;engine = create_engine('sqlite://', connect_args={'check_same_thread': False}, poolclass=StaticPool)&#10;Base.metadata.create_all(engine)&#10;&#10;with Session(engine) as db:&#10;    key = 'idem-test-key-001'&#10;    key_hash = hmac.new('change-rate-limit-secret'.encode(), key.encode(), hashlib.sha256).hexdigest()&#10;    print(f'Key hash: {key_hash}')&#10;    &#10;    existing = db.scalar(select(SubmissionAttempt).where(SubmissionAttempt.idempotency_key == key_hash))&#10;    print(f'Found before: {existing}')&#10;    &#10;    from datetime import datetime, timezone&#10;    db.add(SubmissionAttempt(client_hash='test', idempotency_key=key_hash, created_at=datetime.now(timezone.utc)))&#10;    db.commit()&#10;    &#10;    existing = db.scalar(select(SubmissionAttempt).where(SubmissionAttempt.idempotency_key == key_hash))&#10;    print(f'Found after: {existing}')&#10;    if existing:&#10;        print(f'  idempotency_key: {existing.idempotency_key}')&#10;&quot;" />
+        </Execute>
+        <Execute>
+          <option name="pattern" value="python -c &quot;&#10;from sqlalchemy import create_engine, inspect, text&#10;from sqlalchemy.pool import StaticPool&#10;from app.database import Base&#10;from app.models import SubmissionAttempt&#10;&#10;engine = create_engine('sqlite://', connect_args={'check_same_thread': False}, poolclass=StaticPool)&#10;Base.metadata.create_all(engine)&#10;&#10;inspector = inspect(engine)&#10;columns = inspector.get_columns('submission_attempt')&#10;print('Columns:', [c['name'] for c in columns])&#10;&quot;" />
+        </Execute>
+      </list>
+    </option>
+    <option name="autoApprovedReads">
+      <list>
+        <Read>
+          <option name="pattern" value="/path/to/apps/web/src/pages/index.astro" />
+        </Read>
+        <Read>
+          <option name="pattern" value="/path/to/apps/web/src/lib/api.ts" />
+        </Read>
+        <Read>
+          <option name="pattern" value="/path/to/rf4_spotter/rf4_research/community_cli.py" />
+        </Read>
+      </list>
+    </option>
+  </component>
+</project>

.idea/misc.xml

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="ProjectRootManager">
+    <output url="file://$PROJECT_DIR$/out" />
+  </component>
+</project>

.idea/modules.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="ProjectModuleManager">
+    <modules>
+      <module fileurl="file://$PROJECT_DIR$/.idea/rf4-help.iml" filepath="$PROJECT_DIR$/.idea/rf4-help.iml" />
+    </modules>
+  </component>
+</project>

.idea/rf4-help.iml

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<module type="JAVA_MODULE" version="4">
+  <component name="NewModuleRootManager" inherit-compiler-output="true">
+    <exclude-output />
+    <content url="file://$MODULE_DIR$" />
+    <orderEntry type="inheritedJdk" />
+    <orderEntry type="sourceFolder" forTests="false" />
+  </component>
+</module>

.idea/vcs.xml

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="VcsDirectoryMappings">
+    <mapping directory="" vcs="Git" />
+  </component>
+</project>

AGENTS.md

@@ -0,0 +1,65 @@
+# Repository Guidelines
+
+## Project Structure & Module Organization
+
+RF4 Spotter is an Astro/FastAPI/PostgreSQL application with an offline
+research and media-ingestion toolkit. The main areas are:
+
+- `apps/api/` — FastAPI application, routers, models, migrations, and API tests.
+- `apps/web/` — Astro pages, components, styles, unit tests, and Playwright tests.
+- `rf4_research/` — source parsers, media manifest tooling, and CLI commands.
+- `tests/` — Python research/tooling tests and fixtures.
+- `data/media/` — versioned manifest and content-addressed local media files.
+- `docs/` — specification, roadmap, ADRs, runbooks, and acceptance procedures.
+- `compose.yaml` — local PostgreSQL, API, web, and supporting services.
+
+Keep generated reports and temporary downloads outside committed paths unless a
+task explicitly requires versioning them.
+
+## Build, Test, and Development Commands
+
+From the repository root:
+
+```bash
+.venv/bin/pytest -q                         # Python suites
+npm --prefix apps/web run check             # Astro type/template checks
+npm --prefix apps/web run build             # Check and production build
+npm --prefix apps/web run test:unit         # Web unit tests
+WEB_URL=http://127.0.0.1:4321 npm --prefix apps/web run test:e2e
+docker compose up --build                   # Full local stack
+```
+
+For media work, use `.venv/bin/python -m rf4_research.media_cli --audit` and
+respect the manifest’s cooldown and approval states. Do not hotlink or replace
+approved media without explicit review.
+
+## Coding Style & Naming Conventions
+
+Use four-space indentation for Python and two spaces for Astro/TypeScript.
+Prefer typed Python functions, `snake_case` for Python identifiers, and
+`camelCase` for TypeScript variables/functions. Astro components use
+`PascalCase.astro`; tests use descriptive `test_*.py` or `*.test.ts` names.
+Keep UI text and data-source labels explicit and accessible; run `astro check`
+before committing web changes.
+
+## Testing Guidelines
+
+Add focused regression tests beside the affected suite. Python tests use
+pytest; web behavior uses Node unit tests and Playwright. Run the smallest
+relevant test first, then the full suite before handoff. Never use live external
+sources in tests; use fixtures or isolated Docker services.
+
+## Commit & Pull Request Guidelines
+
+Use imperative, concise commit subjects with the repository’s existing scope
+style, such as `feat:`, `fix:`, `data:`, or `chore:`. Keep commits focused and
+exclude unrelated user files. Pull requests should describe behavior changes,
+verification commands, migration or configuration impact, and screenshots for
+visual/UI work. Call out any media provenance, approval, or rollback decision.
+
+## Security & Configuration Tips
+
+Do not commit secrets, production `.env` files, tokens, or private payloads.
+Use local fixtures and documented environment variables. Preserve the strict
+CSP, admin authentication barriers, source attribution, and media provenance
+when changing application code.

README.md

@@ -6,10 +6,12 @@ RF4 Spotter — неофициальный сервис свежих точек
 
 ## Статус разработки
 
-**Проверка 11 сентября 2026 (`907ad53`): локальный контур готов к развёртыванию открытой альфы, внешний запуск ждёт сервер и его настройки.** Пакет восстановления A01–A13 закрыт. Python: **130 passed, 1 skipped**; Astro check/build и API-тесты проходят. Чистый production bootstrap подтвердил Caddy, scheduler validation, миграцию `20260910_recovery` и браузерный сценарий отправки/модерации. Реальные источники во время приёмки не опрашивались.
+**Проверка 20 сентября 2026: локальный кодовый контур проходит сборочные и тестовые gates, внешний запуск ждёт сервер и его настройки.** Пакет восстановления A01–A13 закрыт. Python: **191 passed, 1 skipped**; Astro check/build и web unit проходят. Граф миграций имеет единственную голову `0020`; OpenAPI artifact синхронизирован с FastAPI (`36 paths`). Изолированный production bootstrap с чистыми томами повторно пройден; живая БД, реальные секреты и импорт внешних источников по-прежнему требуют отдельной инфраструктурной/разрешённой приёмки.
 
 Актуальные следующие задачи находятся только в [ROADMAP](docs/ROADMAP.md). Старые планы и аудиты сохранены как история и больше не задают порядок работ. До внешнего запуска нужны сервер, DNS/TLS, production-секреты, публичные контакты, внешний backup и канал уведомлений.
 
+Разрешённые интеграции и недостающие первичные подтверждения сведены в [реестр разрешений](docs/source-permissions.md). Перед открытой публикацией пустые поля реестра являются блокером конкретного источника, особенно для изображений.
+
 Web Docker-образ устанавливает зависимости через `npm ci` по lock-файлу и удаляет devDependencies после сборки. Локальные `.env` исключены из web build context.
 
 Очередь внешних наблюдений выбирает только ожидающие проверки записи на сервере и показывает их страницами по 50. Обработанные записи не скрывают более старые необработанные наблюдения.
@@ -28,20 +30,38 @@ Web Docker-образ устанавливает зависимости чере
 
 Функциональный MVP и локальный production-контур готовятся к открытой альфе: официальный импорт, пользовательские заявки, модерация, объяснимый индекс, staging внешних источников, адаптивный Astro UI, миграции, резервное копирование, retention, мониторинг и security/accessibility-проверки реализованы. На всех страницах подключён компактный баннер открытой альфы со ссылками на статус, правила и отправку улова. В production Compose включён community scheduler; локально он запускается отдельным профилем. Публичный запуск блокируют покупка и настройка сервера, DNS/TLS, реальные секреты, внешний backup, канал уведомлений; публичный адрес обратной связи ещё не задан.
 
+Главная деградирует по секциям: activity, community signals и справочники загружаются независимо. Частичный отказ сохраняет доступные данные и возвращает HTTP 200 с `X-RF4-Partial` и запретом кэширования; общий 503 возникает только при отказе всех частей.
+
 RF4DB/RF4-STAT/RF4MAP/RF4 Posts сначала принимаются в изолированный staging. Полные записи с ранее подтверждёнными алиасами источника публикуются автоматически; новые соответствия и неполные записи остаются на ручной проверке. Admin API предлагает точные ранее подтверждённые алиасы отдельно от mapping-действия и запрещает молча переназначать alias другой сущности. Для разрешённых community-источников действует интервал не менее 30 минут на сайт, общий для всех его endpoint. Открытая альфа не использует продуктовый allowlist: интерфейс показывает весь корректно загруженный разрешённый каталог, сохраняя требования полноты и модерации.
 
+Жизненный цикл первоисточника учитывается консервативно: изменённая опубликованная запись снимается с активности до повторной ручной проверки, а исчезнувшая — только после подтверждённого ответа `missing` во время разрешённого планового обращения. Временные ошибки и блокировка доступа не удаляют данные. Admin provenance показывает результат и время последней проверки; повторно появившаяся запись также требует подтверждения модератором.
+
 На сайте у каждой записи отображается источник, а у агрегированной активности — все вошедшие в расчёт источники. Неполные community-наблюдения публикуются сразу в отдельной ленте «Полевые сигналы» с предупреждением и перечнем отсутствующих полей; до подтверждения полноты они не влияют на индекс клёва. Лента раскрывается серверной кнопкой «Показать ещё», сохраняет выбранные фильтры и ограничена 48 сигналами на страницу. Визуально объединяются только повторы одного ID источника; похожие записи разных площадок остаются самостоятельными наблюдениями. Sidebar лидера скрывается при единственном результате, чтобы не повторять ту же карточку.
 
 Базовый SEO-контур готов для `rf4spotter.ru`: страницы имеют уникальные метаданные, canonical, Open Graph/Twitter Card, фирменное изображение 1200×630 и JSON-LD; доступны динамические `/robots.txt` и `/sitemap.xml`, административные и ошибочные страницы закрыты от индексации, добавлена собственная страница 404. Индексируемые каталоги рыб и водоёмов, detail-страницы и сочетания водоём + рыба строятся из актуального разрешённого справочника и включаются в sitemap. Подключены резкие favicon/app icons из SVG-мастера, отдельные полнофоновые maskable-иконки, web manifest и production-кэширование статических ресурсов. Карточки активности показывают единый паспорт данных: источники, свежесть, полноту и уровень доверия. На `/status` опубликована легенда цветов всех источников и статусов качества.
 
 Публичные точки используют постоянные читаемые адреса вида `/spots/kuori-85x92`; старые UUID-адреса остаются совместимыми и перенаправляются на канонический URL. На странице точки координаты дополнительно показаны фирменным радаром, который не имитирует отсутствующую географию водоёма, а уловы за 72 часа — шкалой-леской с 12-часовым шагом. Каждый улов показывает источник, относительную свежесть и точное время UTC; время получения явно отделено от времени улова. Каталоги оформлены как полевой атлас: тёмный seal показывает объём справочника, карточки рыб используют смысловые SVG-силуэты, а каждый водоём — собственный детерминированный абстрактный отпечаток берега, волн, точки и индекса. На странице сочетания оба знака собираются в единую атласную эмблему, detail-иерархию связывает breadcrumb-леска с текстовыми узлами, а боковые переходы повторяют знаки связанных сущностей. Это не карта и не игровая география. Пустые состояния используют статичную CSS-иллюстрацию поплавка; смысловые анимации полностью учитывают системное ограничение движения.
 
-Все пять community-парсеров подключены к отдельному scheduler-процессу. Попытка резервируется в PostgreSQL до HTTP-запроса, поэтому ошибки тоже расходуют cooldown. Блокировка и минимальный интервал 1800 секунд действуют на весь домен; endpoint одного сайта выбираются по самому давнему запуску и не голодают. Ручной production-запуск использует тот же журнал: `docker compose exec api python -m app.cli fetch-community rf4stat-fishing`. Локально scheduler включается профилем `docker compose --profile scheduler up -d`; detail-URL RF4MAP/RF4 Posts задаются переменными окружения.
+Все пять community-парсеров подключены к отдельному scheduler-процессу. Попытка резервируется в PostgreSQL до HTTP-запроса, поэтому ошибки тоже расходуют cooldown. Блокировка и минимальный интервал 1800 секунд действуют на весь домен; endpoint одного сайта выбираются по самому давнему запуску и не голодают. Тот же запрос служит проверкой точной исходной ссылки: `404/410` означает `missing`, `401/403/429` — `blocked`, остальные сбои — `temporary_error`; отдельного link-checker и дополнительных обращений нет. Пропажа элемента из агрегатного списка сама по себе удалением не считается. Ручной production-запуск использует тот же журнал: `docker compose exec api python -m app.cli fetch-community rf4stat-fishing`. Локально scheduler включается профилем `docker compose --profile scheduler up -d`; detail-URL RF4MAP/RF4 Posts задаются переменными окружения.
 
-Медиасборщик индексирует разрешённые изображения отдельно от публичного каталога: manifest хранит исходную страницу, URL, предполагаемый тип сущности и время обнаружения, а оригиналы сохраняются по SHA-256 без hotlink. Индексация страницы и загрузка каждого файла используют общий 30-минутный cooldown домена; непроверенный asset не публикуется автоматически. Локальный `media_cli --audit` без сетевых запросов проверяет хэши, файлы, MIME, размеры, approved-сопоставления и отсутствие бесхозных оригиналов.
+Медиасборщик индексирует разрешённые изображения отдельно от публичного каталога: manifest хранит исходную страницу, URL, предполагаемый тип сущности и время обнаружения, а оригиналы сохраняются по SHA-256 без hotlink. После явного разрешения владельца от 14 сентября все скачанные и целостные материалы опубликованы в `/media`; публичный API отдаёт Git-копии по content-addressed URL, а каждая карточка показывает плашку и прямую ссылку на источник. Будущие загрузки по-прежнему не одобряются автоматически. Локальный `media_cli --audit` без сетевых запросов проверяет хэши, файлы, MIME, размеры, approved-сопоставления и отсутствие бесхозных оригиналов.
+
+Актуальный offline-срез от 20.09.2026: 704 записи manifest, 466 `approved`, 226 `superseded`, 1 `duplicate` и 11 `invalid`; audit проходит без ошибок и orphan-файлов. У 252 из 253 рыбных изображений есть 1024×1024 WebP, один 48×48 fallback сохранён из-за отсутствия проверенной альтернативы. Производные WebP/AVIF и provenance хранятся в Git; визуальная browser-приёмка остаётся отдельным пунктом B25.
+
+`python -m rf4_research.media_cli --coverage` сравнивает manifest с датированным `data/media/catalog-baseline.json`: отдельно считает уникальные нормализованные подписи и кандидатов без подписи, поэтому альтернативные URL не завышают покрытие. Актуальный manifest содержит 704 записи: 466 approved, 226 superseded, 1 duplicate и 11 invalid; queue-представления больше нет. Опубликованы 253 fish-файла, все 149 найденных изображений снастей/приманок и 64 справочных материала; общий target снастей остаётся `null` до проверяемого полного счётчика. Водоёмы имеют отдельный canonical index из 19 карточек; detail-наполнение остаётся W02–W08.
+
+`python -m rf4_research.media_cli --quality-report` выполняет offline-проверку разрешения опубликованных рыб. Контур quality-upgrade обработал 226 прямых RF4DB-альтернатив: 252 из 253 рыбных изображений теперь имеют 1024×1024 WebP, один 48×48 fallback сохранён из-за отсутствия проверенной альтернативы. `--queue-quality-upgrades` по-прежнему переводит только прямые альтернативы низкоразрешённых published-файлов в безопасную очередь, не снимая текущую версию с публикации; B21/B22 завершены, а browser-приёмка остаётся отдельным пунктом B25.
+
+`python -m rf4_research.media_cli --queue-plan` без сетевых запросов объединяет manifest с общим cooldown-state: показывает queued-состав каждого домена, оставшееся время и наиболее полезный следующий asset с приоритетом водоёмов и рыб. Разрешённое media-окно загружается командой `--download-batch --batch-limit 40`: до 40 assets на домен под одной резервацией, затем 30 минут до нового batch. Блокировка/rate limit/сетевая ошибка останавливает домен сразу, три последовательных невалидных ответа — досрочно. Все файлы остаются в карантине до ручного review. Точный поимённый список отсутствующих сущностей появится только после получения канонического перечня; разница между двумя несогласованными каталогами не выдаётся за доказанный gap.
+
+Актуальный внешний ориентир — 19 водоёмов и 252 вида рыб; локальная альфа пока содержит 2+2 справочные сущности. Media-manifest включает 704 записи из RF4MAP, RF4DB и официального руководства: 456 опубликованы, 227 являются альтернативными дубликатами, 10 ожидают загрузки и 11 URL невалидны. Все 456 оригиналов находятся в Git; подтверждённых entity-карт водоёмов пока нет. Полное число «снастей» не заявляется: приманки — лишь одна часть каталога наряду с удилищами, катушками, лесками, крючками и оснастками.
+
+Исследовательские RF4-ассеты в `data/media/files/` версионируются обычным Git вместе с `data/media/manifest.json`, чтобы клон репозитория был самодостаточным и не зависел от локального кэша. Это не относится к пользовательским скриншотам: они по-прежнему хранятся в MinIO/S3 и не попадают в Git.
 
 Для измерений на собственном сервере подготовлен read-only `deploy/load-smoke.py`: он считает p50/p95/max и HTTP-коды для activity/records, а при наличии `ADMIN_TOKEN` — staging/moderation. Методика и безопасные ступени нагрузки описаны в [docs/load-testing.md](docs/load-testing.md); локальные цифры не выдаются за production baseline.
 
+До сервера запросы проверяются командой `./deploy/test-query-plans.sh`: session-local TEMP-fixture на 100 000 уловов не меняет рабочую БД и требует индексные планы для activity, records и spot detail, а также выполнение пяти публичных планов быстрее 250 мс. Методика и последний локальный результат находятся в [docs/query-performance.md](docs/query-performance.md); новые индексы по текущему измерению не требуются.
+
 В production MinIO root credentials доступны только одноразовому init-контейнеру. API использует отдельного пользователя с доступом исключительно к `S3_BUCKET`: просмотр bucket, чтение, запись и удаление его объектов без глобального списка bucket и без права создавать новые.
 
 Production release отделяет Alembic от runtime: одноразовый `migrate` должен успешно завершиться до запуска новой версии API. Перед изменением схемы создаётся backup; совместимый rollback возвращает предыдущие images, несовместимый — восстанавливает предрелизную копию данных вместо непроверенного `alembic downgrade`.
@@ -50,6 +70,8 @@ Production release отделяет Alembic от runtime: одноразовый
 
 Тяжёлый production bootstrap вынесен в отдельный ручной/еженедельный CI workflow с 30-минутным timeout и сохраняемыми diagnostics; обычный push по-прежнему использует быстрый Compose E2E.
 
+Публичный API зафиксирован генерируемым [OpenAPI-контрактом](docs/api-contract.md): CI сравнивает `apps/api/openapi.json` с фактической схемой FastAPI, поэтому рефакторинг routers не может незаметно изменить URL, параметры или response models. Catalog, activity/spots, public data, submissions и admin API принадлежат отдельным `APIRouter`; `main.py` служит компактной точкой сборки приложения, а проверка доверенных proxy и persistent rate limit изолированы в `submission_security`.
+
 После повторных ошибок scheduler увеличивает паузу экспоненциально до 24 часов и возвращается к 30 минутам после успеха. Публичная страница `/status` показывает свежесть и состояние источников без URL запросов, внутренних ошибок и другой диагностической информации.
 
 Подробный план и актуальные чекбоксы находятся в [`docs/ROADMAP.md`](docs/ROADMAP.md). Результаты проверки интерфейса и пять приоритетных UX-пакетов описаны в [`docs/UI_UX_AUDIT.md`](docs/UI_UX_AUDIT.md).
@@ -59,6 +81,10 @@ Production-контур для домена `rf4spotter.ru`, TLS, секреты
 Политика минимизации данных и ежедневная dry-run-first очистка описаны в [`docs/data-retention.md`](docs/data-retention.md).
 
 Host-side мониторинг контейнеров, readiness, диска, объёма PostgreSQL/MinIO, резервных копий и TLS описан в [`docs/production-monitoring.md`](docs/production-monitoring.md).
+
+Минимальные SLI открытой альфы, стартовые пороги и правила безопасной телеметрии собраны в [observability plan](docs/observability.md). До выбора сервера используются существующие JSON-логи, readiness, diagnostics и host monitor; отдельный metrics-стек заранее не добавляется.
+
+Принятые границы стека, memory-cache, scheduler и хранилищ зафиксированы в [архитектурных решениях](docs/architecture-decisions.md). Порядок действий при заполнении диска, отказах PostgreSQL/MinIO, зависшем импорте, ошибке миграции и утечке секрета находится в [incident runbook](docs/incident-runbook.md).
 Ежедневный systemd timer создаёт проверяемую копию до retention-очистки, а production Compose ограничивает рост JSON-логов контейнеров.
 
 Фактическое состояние DNS/TLS домена и серверный чек-лист ведутся в [`docs/deployment-status.md`](docs/deployment-status.md).
@@ -77,6 +103,10 @@ FastAPI ─ PostgreSQL 17
 
 Наружу production-профиль публикует только Caddy. PostgreSQL, API, Astro и MinIO находятся в Docker-сетях. Caddy завершает TLS и защищает административные страницы Basic Auth; административный API отдельно проверяет Bearer-токен в FastAPI. Basic не накладывается на API-запросы.
 
+Production CSP ограничивает browser-запросы текущим доменом и отдельным files-доменом для изображений, запрещает plugins, frames, inline handlers и attributes, `unsafe-inline`, eval, wildcard и HTTP. Page scripts и scoped styles выпускаются отдельными same-origin `_astro`-ассетами; динамический JSON-LD получает новый криптографический nonce на каждый SSR-ответ. Caddy сохраняет эту policy и задаёт строгий fallback для служебных ответов. Локальный Compose отдельно разрешает только loopback API/MinIO; детали и проверка описаны в [CSP inventory](docs/csp-inventory.md).
+
+Тема по умолчанию следует системному `prefers-color-scheme`, а переключатель в header позволяет выбрать системную, светлую или тёмную палитру. Выбор сохраняется в cookie и применяется Astro при SSR без localStorage-only flash и ослабления CSP; browser chrome синхронизируется парными `theme-color`. Публичные и административные поверхности, формы, таблицы, provenance/status-плашки и фирменная SVG/CSS-графика используют семантические light/dark-токены и базовый forced-colors layer; ограничения и оставшаяся визуальная приёмка описаны в [dark-theme.md](docs/dark-theme.md).
+
 Gitea Actions workflow `.gitea/workflows/ci.yml` на каждый push и pull request проверяет Python, миграции на чистой PostgreSQL, Astro build и полный Compose/Playwright-сценарий. При падении E2E сохраняются логи контейнеров и Playwright-артефакты.
 
 Актуальная инвентаризация источников и правила подключения адаптеров находятся в [`docs/data-source-audit.md`](docs/data-source-audit.md). Разрешённый технический пилот RF4DB/RF4-STAT описан в [`docs/community-source-pilot.md`](docs/community-source-pilot.md), а статус разрешений и лимитов — в [`docs/data-permissions.md`](docs/data-permissions.md). Все наблюдения сначала попадают в staging. Полные записи с уже подтверждёнными алиасами могут публиковаться автоматически; новые соответствия требуют модерации, а неполные записи показываются отдельно и не влияют на индекс.
@@ -118,7 +148,7 @@ docker compose up --build
 - readiness PostgreSQL, MinIO и импорта с версией/revision сборки: <http://localhost:8000/ready>;
 - консоль MinIO: <http://localhost:9001>.
 
-Контейнер API сам выполняет `alembic upgrade head`, затем идемпотентный seed. PostgreSQL хранит данные в именованном volume `postgres_data`, а MinIO — в `minio_data`. Compose ожидает readiness PostgreSQL и MinIO перед API, а API-контейнер проверяет `/ready`. Версия и commit SHA задаются через `APP_VERSION`/`APP_REVISION`; те же значения доступны администратору в `/api/v1/admin/diagnostics`. Официальный импорт по умолчанию необязателен; при включённом scheduler установите `OFFICIAL_IMPORT_REQUIRED=true`, тогда отсутствующий, неуспешный или просроченный запуск сделает readiness отрицательным.
+Одноразовые контейнеры `migrate` и `minio-init` перед запуском API соответственно применяют `alembic upgrade head` и идемпотентно создают локальный `S3_BUCKET`; приложение само не создаёт схему или bucket. PostgreSQL хранит данные в именованном volume `postgres_data`, а MinIO — в `minio_data`. Compose ожидает readiness PostgreSQL, MinIO и успешное завершение обоих init-контейнеров перед API, а API-контейнер проверяет `/ready`. Версия и commit SHA задаются через `APP_VERSION`/`APP_REVISION`; те же значения доступны администратору в `/api/v1/admin/diagnostics`. Здоровье импортов диагностическое и не мешает API или scheduler восстановиться после сбоя.
 
 API и scheduler пишут по одной JSON-записи на событие. HTTP-лог содержит только сгенерированный `request_id`, метод, путь без query string, статус и длительность; IP, заголовок авторизации и пользовательский payload не журналируются. `X-Request-ID` возвращается клиенту. Стандартный access-log Uvicorn отключён. Уровень управляется `LOG_LEVEL`. Публичный агрегат активности кэшируется в памяти процесса на 20 секунд (до 128 ключей) и очищается после публикации, модерации или удаления через этот процесс API; изменения scheduler видны после TTL; `X-Cache` показывает `HIT`/`MISS`. Защищённый `/api/v1/admin/diagnostics` скачивает JSON только с идентификатором сборки и агрегированными счётчиками, без имён игроков, исходных URL, payload и ошибок парсеров.
 
@@ -154,7 +184,7 @@ docker compose up --build
 ## Что реализовано
 
 - FastAPI и SQLAlchemy 2;
-- PostgreSQL 17 и миграции Alembic до `20260910_recovery`;
+- PostgreSQL 17 и линейные миграции Alembic до `0020`;
 - идемпотентный seed с двумя точками и свежими демо-уловами;
 - `GET /api/v1/activity` с фильтрами периода, водоёма, рыбы, способа и сортировки;
 - `GET /api/v1/spots/{id}` и `/catches`;
@@ -240,9 +270,21 @@ curl -H "Authorization: Bearer change-me-in-production" \
 
 Если создание записи прошло успешно, а загрузка скриншота завершилась ошибкой, форма сохраняет на один час ID заявки и одноразовый секрет в защищённой `HttpOnly` cookie и предлагает повторить только загрузку изображения. Повторно отправлять сам улов не требуется; один UUID заявки не даёт права изменить чужую запись.
 
-Очередь модерации доступна по адресу <http://localhost:4321/admin/moderation>. Администратор вводит `ADMIN_TOKEN`; интерфейс держит его только в памяти открытой страницы и не сохраняет в URL или браузерном хранилище.
+Единый dashboard доступен по адресу <http://localhost:4321/admin>, очереди — `/admin/moderation` и `/admin/external-sources`. Dashboard показывает объём очередей, состояние источников и последние импорты без внутренних URL и текстов ошибок. Администратор вводит `ADMIN_TOKEN`; интерфейс держит его только в памяти открытой страницы и не сохраняет в URL или браузерном хранилище. После 15 минут бездействия или ответа API `401` сессия очищается; также доступен явный выход.
 
-Администратор может одобрить, отклонить или удалить сообщение. Удаление очищает ник, комментарий, исходную ссылку и объект скриншота, исключает запись из статистики, но сохраняет обезличенный факт действия в журнале аудита.
+В production HTML административных страниц дополнительно закрыт Caddy Basic Auth, а API независимо проверяет Bearer-токен. Неуспешные попытки API-входа считаются в БД по HMAC-идентификатору адреса и временно блокируются после десяти ошибок за десять минут; успешная авторизация очищает ошибки клиента. Интерфейс открывает только ссылки со схемой `http` или `https`; данные источника не могут подставить исполняемую URL-схему в ссылку или превью.
+
+Администратор может одобрить, отклонить или удалить сообщение. Очередь внешних наблюдений фильтруется на сервере по источнику и полноте, ищет рыбу/водоём и сортируется по свежести либо риску до применения пагинации; риск поднимает неполные и несопоставленные записи. Во время решения вся карточка блокируется; при ошибке введённая причина остаётся на месте, а после успеха интерфейс сообщает результат и переводит фокус к следующей записи. Удаление очищает ник, комментарий, исходную ссылку и объект скриншота, исключает запись из статистики, но сохраняет обезличенный факт действия в журнале аудита.
+
+Для карточки с клавиатурным фокусом доступны подсказанные в интерфейсе быстрые клавиши одобрения, сопоставления и публикации. Они не срабатывают в полях ввода; отклонение и удаление требуют явного нажатия кнопки.
+
+Административный API внешней очереди возвращает безопасный provenance: время первого и последнего обнаружения, время проверки, отсутствующие поля и только разрешённые скалярные поля исходной записи. Неизвестные ключи и вложенные служебные структуры в ответ не попадают.
+
+В карточке внешнего наблюдения provenance доступен в отдельном раскрываемом блоке: временная линия, отсутствующие и исходные разрешённые поля видны до сопоставления и публикации.
+
+`GET /api/v1/admin/moderation-history` объединяет историю решений по пользовательским уловам и внешним наблюдениям; последние события видны на dashboard. Ответ содержит только тип и UUID сущности, время, действие, оператора и причину — без ников, исходных URL и parser payload. Dashboard выгружает отдельный `moderation-history-export`: в нём дополнительно исключены UUID, оператор и свободный текст причины, остаются только время, тип, действие и признак необходимости подтверждения.
+
+Решения в обеих очередях используют optimistic locking: API возвращает `moderation_version`, а изменяющий запрос обязан прислать увиденное значение. Проверка выполняется под блокировкой строки; если другая вкладка уже решила запись, сервер отвечает `409`, UI обновляет очередь и не перезаписывает более новое решение.
 
 ## Эксплуатация production
 

apps/api/Dockerfile

@@ -6,6 +6,7 @@ RUN pip install --no-cache-dir -r requirements-lock.txt
 RUN useradd --create-home --uid 10001 rf4
 COPY --chown=rf4:rf4 apps/api .
 COPY --chown=rf4:rf4 rf4_research ./rf4_research
+COPY --chown=rf4:rf4 data/media ./data/media
 USER rf4
 EXPOSE 8000
 CMD ["sh", "-c", "python -m app.seed && uvicorn app.main:app --host 0.0.0.0 --port 8000 --no-access-log"]

apps/api/alembic/versions/0014_admin_auth_attempt.py

@@ -0,0 +1,27 @@
+"""Add persistent administrative authentication rate limit."""
+
+from alembic import op
+import sqlalchemy as sa
+
+revision = "0014"
+down_revision = "20260910_recovery"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "admin_auth_attempt",
+        sa.Column("id", sa.Uuid(), nullable=False),
+        sa.Column("client_hash", sa.String(length=64), nullable=False),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
+        sa.PrimaryKeyConstraint("id"),
+    )
+    op.create_index("ix_admin_auth_attempt_client_hash", "admin_auth_attempt", ["client_hash"])
+    op.create_index("ix_admin_auth_attempt_created_at", "admin_auth_attempt", ["created_at"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_admin_auth_attempt_created_at", table_name="admin_auth_attempt")
+    op.drop_index("ix_admin_auth_attempt_client_hash", table_name="admin_auth_attempt")
+    op.drop_table("admin_auth_attempt")

apps/api/alembic/versions/0015_moderation_version.py

@@ -0,0 +1,22 @@
+"""add optimistic moderation versions
+
+Revision ID: 0015
+Revises: 0014
+"""
+from alembic import op
+import sqlalchemy as sa
+
+revision = "0015"
+down_revision = "0014"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column("catch_report", sa.Column("moderation_version", sa.Integer(), nullable=False, server_default="0"))
+    op.add_column("external_observation", sa.Column("moderation_version", sa.Integer(), nullable=False, server_default="0"))
+
+
+def downgrade() -> None:
+    op.drop_column("external_observation", "moderation_version")
+    op.drop_column("catch_report", "moderation_version")

apps/api/alembic/versions/0016_source_lifecycle.py

@@ -0,0 +1,24 @@
+"""track source record lifecycle checks
+
+Revision ID: 0016
+Revises: 0015
+"""
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = "0016"
+down_revision = "0015"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column("external_observation", sa.Column("source_check_status", sa.String(length=30)))
+    op.add_column("external_observation", sa.Column("source_checked_at", sa.DateTime(timezone=True)))
+
+
+def downgrade() -> None:
+    op.drop_column("external_observation", "source_checked_at")
+    op.drop_column("external_observation", "source_check_status")

apps/api/alembic/versions/0017_waterbody_provenance.py

@@ -0,0 +1,37 @@
+"""add canonical waterbody provenance fields
+
+Revision ID: 0017
+Revises: 0016
+"""
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = "0017"
+down_revision = "0016"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column("waterbody", sa.Column("source_system", sa.String(length=50), nullable=True))
+    op.add_column("waterbody", sa.Column("source_external_id", sa.String(length=200), nullable=True))
+    op.add_column("waterbody", sa.Column("source_url", sa.Text(), nullable=True))
+    op.add_column("waterbody", sa.Column("description", sa.Text(), nullable=True))
+    op.add_column("waterbody", sa.Column("source_checked_at", sa.DateTime(timezone=True), nullable=True))
+    op.create_index(
+        "uq_waterbody_source_identity",
+        "waterbody",
+        ["source_system", "source_external_id"],
+        unique=True,
+    )
+
+
+def downgrade() -> None:
+    op.drop_index("uq_waterbody_source_identity", table_name="waterbody")
+    op.drop_column("waterbody", "source_checked_at")
+    op.drop_column("waterbody", "description")
+    op.drop_column("waterbody", "source_url")
+    op.drop_column("waterbody", "source_external_id")
+    op.drop_column("waterbody", "source_system")

apps/api/alembic/versions/0018_coordinate_precision.py

@@ -0,0 +1,26 @@
+"""store source coordinate text and precision
+
+Revision ID: 0018
+Revises: 0017
+"""
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = "0018"
+down_revision = "0017"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column("external_observation", sa.Column("coordinate_raw", sa.String(length=200), nullable=True))
+    op.add_column("external_observation", sa.Column("coordinate_precision", sa.String(length=20), nullable=True))
+    op.execute("UPDATE external_observation SET coordinate_precision = CASE WHEN x IS NOT NULL AND y IS NOT NULL THEN 'exact' ELSE 'missing' END")
+    op.alter_column("external_observation", "coordinate_precision", nullable=False, server_default="missing")
+
+
+def downgrade() -> None:
+    op.drop_column("external_observation", "coordinate_precision")
+    op.drop_column("external_observation", "coordinate_raw")

apps/api/alembic/versions/0019_waterbody_fish_count.py

@@ -0,0 +1,22 @@
+"""store canonical waterbody fish count
+
+Revision ID: 0019
+Revises: 0018
+"""
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = "0019"
+down_revision = "0018"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column("waterbody", sa.Column("fish_species_count", sa.Integer(), nullable=True))
+
+
+def downgrade() -> None:
+    op.drop_column("waterbody", "fish_species_count")

apps/api/alembic/versions/0020_waterbody_detail_fields.py

@@ -0,0 +1,24 @@
+"""store canonical waterbody detail facts
+
+Revision ID: 0020
+Revises: 0019
+"""
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = "0020"
+down_revision = "0019"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    for name in ("source_aliases", "source_fish_species", "source_image_urls", "source_point_urls"):
+        op.add_column("waterbody", sa.Column(name, sa.JSON(), nullable=True))
+
+
+def downgrade() -> None:
+    for name in ("source_point_urls", "source_image_urls", "source_fish_species", "source_aliases"):
+        op.drop_column("waterbody", name)

apps/api/alembic/versions/0021_tackle_catalog.py

@@ -0,0 +1,65 @@
+"""add canonical tackle items and rig components
+
+Revision ID: 0021
+Revises: 0020
+"""
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = "0021"
+down_revision = "0020"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "tackle_item",
+        sa.Column("id", sa.Uuid(), primary_key=True),
+        sa.Column("name", sa.String(200), nullable=False),
+        sa.Column("normalized_name", sa.String(200), nullable=False, unique=True),
+        sa.Column("category", sa.String(20), nullable=False),
+        sa.Column("subcategory", sa.String(100)),
+        sa.Column("brand", sa.String(100)),
+        sa.Column("family", sa.String(100)),
+        sa.Column("unlock_level", sa.Integer()),
+        sa.Column("source_system", sa.String(50)),
+        sa.Column("source_external_id", sa.String(200)),
+        sa.Column("source_url", sa.Text()),
+        sa.Column("source_checked_at", sa.DateTime(timezone=True)),
+        sa.Column("raw_payload", sa.JSON()),
+        sa.UniqueConstraint("source_system", "source_external_id"),
+        sa.CheckConstraint(
+            "category IN ('bait', 'lure', 'rod', 'reel', 'line', 'hook', 'rig', 'float', 'sinker', 'other')",
+            name="ck_tackle_item_category",
+        ),
+    )
+    op.create_table(
+        "rig",
+        sa.Column("id", sa.Uuid(), primary_key=True),
+        sa.Column("name", sa.String(200), nullable=False),
+        sa.Column("normalized_name", sa.String(200), nullable=False, unique=True),
+        sa.Column("source_system", sa.String(50)),
+        sa.Column("source_external_id", sa.String(200)),
+        sa.Column("source_url", sa.Text()),
+        sa.Column("source_checked_at", sa.DateTime(timezone=True)),
+        sa.Column("raw_payload", sa.JSON()),
+    )
+    op.create_table(
+        "rig_component",
+        sa.Column("id", sa.Uuid(), primary_key=True),
+        sa.Column("rig_id", sa.Uuid(), sa.ForeignKey("rig.id"), nullable=False),
+        sa.Column("tackle_item_id", sa.Uuid(), sa.ForeignKey("tackle_item.id")),
+        sa.Column("role", sa.String(50), nullable=False),
+        sa.Column("position", sa.Integer(), nullable=False),
+        sa.Column("raw_value", sa.String(200)),
+        sa.UniqueConstraint("rig_id", "position"),
+    )
+
+
+def downgrade() -> None:
+    op.drop_table("rig_component")
+    op.drop_table("rig")
+    op.drop_table("tackle_item")

apps/api/alembic/versions/0022_catch_tackle_components.py

@@ -0,0 +1,40 @@
+"""preserve ordered gear evidence on catches
+
+Revision ID: 0022
+Revises: 0021
+"""
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = "0022"
+down_revision = "0021"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "catch_tackle_component",
+        sa.Column("id", sa.Uuid(), primary_key=True),
+        sa.Column("catch_report_id", sa.Uuid(), sa.ForeignKey("catch_report.id"), nullable=False),
+        sa.Column("tackle_item_id", sa.Uuid(), sa.ForeignKey("tackle_item.id")),
+        sa.Column("rig_id", sa.Uuid(), sa.ForeignKey("rig.id")),
+        sa.Column("role", sa.String(50), nullable=False),
+        sa.Column("position", sa.Integer(), nullable=False),
+        sa.Column("raw_value", sa.String(200), nullable=False),
+        sa.Column("source_system", sa.String(50)),
+        sa.Column("source_external_id", sa.String(200)),
+        sa.Column("source_url", sa.Text()),
+        sa.Column("raw_payload", sa.JSON()),
+        sa.UniqueConstraint("catch_report_id", "position"),
+        sa.CheckConstraint(
+            "NOT (tackle_item_id IS NOT NULL AND rig_id IS NOT NULL)",
+            name="ck_catch_tackle_one_canonical_target",
+        ),
+    )
+
+
+def downgrade() -> None:
+    op.drop_table("catch_tackle_component")

apps/api/app/activity.py

@@ -61,6 +61,9 @@ def activity_rows(
             confidence = min(confidence, 50)
         elif len(players) == 2:
             confidence = min(confidence, 65)
+        coordinate_precisions = {_coordinate_precision(item) for item in items}
+        coordinate_precision = max(coordinate_precisions, key=_precision_rank)
+        coordinate_sources = sorted({_source_system(item) for item in items})
         latest = max(_aware(r.reported_at) for r in items)
         baits = Counter(r.bait.name for r in items if r.bait)
         freshness_text = _freshness_text(now - latest)
@@ -74,7 +77,9 @@ def activity_rows(
             max_weight_g=max(r.weight_g for r in items), last_confirmed_at=latest,
             activity_score=activity, confidence_score=confidence,
             explanation=_explanation(len(items), len(players), freshness_text, activity, confidence),
-            sources=sorted({_source_system(item) for item in items}),
+            sources=coordinate_sources,
+            coordinate_precision=coordinate_precision,
+            coordinate_sources=coordinate_sources,
         ))
     return sorted(result, key=lambda row: (row.activity_score, row.last_confirmed_at), reverse=True)
 
@@ -90,6 +95,16 @@ def _source_system(report: CatchReport) -> str:
     return "manual-import"
 
 
+def _coordinate_precision(report: CatchReport) -> str:
+    provenance = (report.raw_payload or {}).get("provenance", {})
+    value = provenance.get("coordinate_precision") if isinstance(provenance, dict) else None
+    return value if value in {"exact", "approximate", "area", "missing"} else "exact"
+
+
+def _precision_rank(value: str) -> int:
+    return {"exact": 0, "approximate": 1, "area": 2, "missing": 3}[value]
+
+
 def _aware(value: datetime) -> datetime:
     return value if value.tzinfo else value.replace(tzinfo=timezone.utc)
 

apps/api/app/admin_security.py

@@ -0,0 +1,59 @@
+from datetime import datetime, timedelta, timezone
+import hashlib
+import hmac
+
+from fastapi import HTTPException, Request
+from sqlalchemy import delete, func, select, text
+from sqlalchemy.orm import Session
+
+from .models import AdminAuthAttempt
+from .submission_security import RateLimitConfig, client_address
+
+
+class AdminAuthConfig(RateLimitConfig):
+    admin_token: str
+    admin_auth_attempt_limit: int
+    admin_auth_window_seconds: int
+
+
+def verify_admin(
+    request: Request,
+    db: Session,
+    authorization: str | None,
+    config: AdminAuthConfig,
+) -> str:
+    now = datetime.now(timezone.utc)
+    cutoff = now - timedelta(seconds=config.admin_auth_window_seconds)
+    client = client_address(request, config.trusted_proxy_cidrs)
+    client_hash = hmac.new(
+        config.rate_limit_secret.encode(), f"admin:{client}".encode(), hashlib.sha256
+    ).hexdigest()
+    if db.get_bind().dialect.name == "postgresql":
+        lock_key = int(client_hash[:16], 16) & 0x7FFF_FFFF_FFFF_FFFF
+        db.execute(text("SELECT pg_advisory_xact_lock(:lock_key)"), {"lock_key": lock_key})
+    db.execute(delete(AdminAuthAttempt).where(AdminAuthAttempt.created_at < now - timedelta(days=1)))
+    failures = db.scalar(
+        select(func.count()).select_from(AdminAuthAttempt).where(
+            AdminAuthAttempt.client_hash == client_hash,
+            AdminAuthAttempt.created_at >= cutoff,
+        )
+    ) or 0
+    if failures >= config.admin_auth_attempt_limit:
+        db.commit()
+        raise HTTPException(
+            status_code=429,
+            detail="too many admin authentication attempts",
+            headers={"Retry-After": str(config.admin_auth_window_seconds)},
+        )
+    expected = f"Bearer {config.admin_token}"
+    if not authorization or not hmac.compare_digest(authorization, expected):
+        db.add(AdminAuthAttempt(client_hash=client_hash, created_at=now))
+        db.commit()
+        raise HTTPException(
+            status_code=401,
+            detail="invalid admin token",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+    db.execute(delete(AdminAuthAttempt).where(AdminAuthAttempt.client_hash == client_hash))
+    db.commit()
+    return "admin"

apps/api/app/catalog_audit.py

@@ -15,3 +15,28 @@ def audit_catalog(db: Session) -> dict[str, int]:
         "incomplete_published_staging": db.scalar(select(func.count()).select_from(ExternalObservation).where(ExternalObservation.status == "published", or_(ExternalObservation.fish_id.is_(None), ExternalObservation.waterbody_id.is_(None), ExternalObservation.x.is_(None), ExternalObservation.y.is_(None), ExternalObservation.weight_g.is_(None), ExternalObservation.catch_report_id.is_(None)))) or 0,
     }
     return {"fishes": count(Fish), "waterbodies": count(Waterbody), "reports": count(CatchReport), "staging": count(ExternalObservation), **failures, "failures": sum(failures.values())}
+
+
+def audit_waterbody_catalog(db: Session, expected_ids: set[str]) -> dict:
+    """Check a verified RF4DB snapshot without withdrawing legacy rows."""
+    rows = list(db.scalars(select(Waterbody).where(Waterbody.source_system == "rf4db")))
+    observed_ids = [str(row.source_external_id) for row in rows if row.source_external_id]
+    observed = set(observed_ids)
+    duplicate_ids = sorted({item for item in observed_ids if observed_ids.count(item) > 1})
+    missing = sorted(expected_ids - observed)
+    unexpected = sorted(observed - expected_ids)
+    provenance_issues = sorted(
+        str(row.source_external_id)
+        for row in rows
+        if not row.source_external_id or not row.source_url or not row.source_checked_at
+    )
+    failures = len(missing) + len(duplicate_ids) + len(provenance_issues)
+    return {
+        "expected": len(expected_ids),
+        "observed": len(observed),
+        "missing_source_external_ids": missing,
+        "unexpected_source_external_ids": unexpected,
+        "duplicate_source_external_ids": duplicate_ids,
+        "provenance_issues": provenance_issues,
+        "failures": failures,
+    }

apps/api/app/cli.py

@@ -8,10 +8,10 @@ from dataclasses import asdict
 from .config import settings
 from .database import SessionLocal
 from .importer import import_records
-from .community_importer import stage_observations
+from .community_importer import stage_observations, update_waterbody_detail, update_waterbody_details, upsert_waterbody_catalog
 from .retention import RetentionPolicy, apply_retention
 from .storage import delete_screenshot
-from .catalog_audit import audit_catalog
+from .catalog_audit import audit_catalog, audit_waterbody_catalog
 from .community_scheduler import run_source, configured_sources
 
 # Static registry for argparse choices — no DB required for --help
@@ -34,11 +34,20 @@ def main() -> int:
     community = sub.add_parser("stage-community-json")
     community.add_argument("--input", default="-", help="JSON array path or - for stdin")
     community.add_argument("--limit", type=int, default=500)
+    waterbodies = sub.add_parser("import-waterbody-catalog")
+    waterbodies.add_argument("--input", required=True, help="JSON snapshot path or - for stdin")
+    waterbodies.add_argument("--limit", type=int, default=100)
+    detail = sub.add_parser("import-waterbody-detail")
+    detail.add_argument("--input", required=True, help="JSON detail snapshot path")
+    details = sub.add_parser("import-waterbody-details")
+    details.add_argument("--input", required=True, help="JSON array of detail snapshots")
     fetch_community = sub.add_parser("fetch-community")
     fetch_community.add_argument("source", choices=STATIC_SOURCE_CHOICES)
     cleanup = sub.add_parser("cleanup-retention")
     cleanup.add_argument("--apply", action="store_true", help="apply changes; default is dry-run")
     sub.add_parser("audit-catalog")
+    waterbody_audit = sub.add_parser("audit-waterbody-catalog")
+    waterbody_audit.add_argument("--input", required=True, help="JSON snapshot path")
     args = parser.parse_args()
     with SessionLocal() as session:
         if args.command == "import-records":
@@ -57,6 +66,43 @@ def main() -> int:
                 parser.error("input must be a JSON array")
             created, updated = stage_observations(session, payload[:args.limit])
             print(f"staged: created={created} updated={updated}")
+        elif args.command == "import-waterbody-catalog":
+            if not 1 <= args.limit <= 500:
+                parser.error("--limit must be between 1 and 500")
+            stream = sys.stdin if args.input == "-" else open(args.input, encoding="utf-8")
+            try:
+                snapshot = json.load(stream)
+            finally:
+                if stream is not sys.stdin:
+                    stream.close()
+            if isinstance(snapshot, dict):
+                payload = snapshot.get("items")
+                source_system = snapshot.get("source_system")
+                if isinstance(payload, list) and isinstance(source_system, str):
+                    payload = [
+                        {"source_system": source_system, **item}
+                        for item in payload if isinstance(item, dict)
+                    ]
+            else:
+                payload = snapshot
+            if not isinstance(payload, list):
+                parser.error("input must be a JSON array or an object with an items array")
+            created, updated = upsert_waterbody_catalog(session, payload[:args.limit])
+            print(f"waterbodies: created={created} updated={updated}")
+        elif args.command == "import-waterbody-detail":
+            with open(args.input, encoding="utf-8") as stream:
+                payload = json.load(stream)
+            if not isinstance(payload, dict):
+                parser.error("input must be a JSON object")
+            update_waterbody_detail(session, payload)
+            print(f"waterbody detail: updated={payload.get('source_external_id', 'unknown')}")
+        elif args.command == "import-waterbody-details":
+            with open(args.input, encoding="utf-8") as stream:
+                payload = json.load(stream)
+            if not isinstance(payload, list):
+                parser.error("input must be a JSON array")
+            created, updated = update_waterbody_details(session, payload)
+            print(f"waterbody details: created={created} updated={updated}")
         elif args.command == "fetch-community":
             # A09: Verify source is enabled at runtime (not just in static choices)
             enabled = configured_sources()
@@ -76,6 +122,24 @@ def main() -> int:
             )
             counts = apply_retention(session, policy=policy, dry_run=not args.apply, delete_object=delete_screenshot)
             print(json.dumps({"mode": "apply" if args.apply else "dry-run", "policy": asdict(policy), "counts": counts}, ensure_ascii=False))
+        elif args.command == "audit-waterbody-catalog":
+            stream = sys.stdin if args.input == "-" else open(args.input, encoding="utf-8")
+            try:
+                snapshot = json.load(stream)
+            finally:
+                if stream is not sys.stdin:
+                    stream.close()
+            items = snapshot.get("items") if isinstance(snapshot, dict) else snapshot
+            if not isinstance(items, list):
+                parser.error("input must be a JSON array or an object with an items array")
+            expected_ids = {
+                str(item["source_external_id"])
+                for item in items
+                if isinstance(item, dict) and item.get("source_external_id")
+            }
+            result = audit_waterbody_catalog(session, expected_ids)
+            print(json.dumps(result, ensure_ascii=False))
+            return 1 if result["failures"] else 0
         else:
             result = audit_catalog(session)
             print(json.dumps(result, ensure_ascii=False))

apps/api/app/community_importer.py

@@ -1,6 +1,8 @@
 from __future__ import annotations
 
 import json
+import hashlib
+import re
 from datetime import datetime, timezone
 from typing import Any, Iterable
 from urllib.parse import urlparse
@@ -26,12 +28,153 @@ SOURCE_HOSTS = {
     "rf4map": {"rf4map.ru"},
     "rf4posts-spot": {"rf4-posts.com"},
 }
+COORDINATE_PRECISIONS = frozenset({"exact", "approximate", "area", "missing"})
 
 
 class CommunityImportError(ValueError):
     pass
 
 
+def upsert_waterbody_catalog(
+    session: Session, rows: Iterable[dict[str, Any]], *, fetched_at: datetime | None = None,
+) -> tuple[int, int]:
+    """Apply a validated canonical waterbody snapshot without destructive sync.
+
+    Rows are matched by the RF4DB source identity first and by an exact existing
+    name second. Missing rows are deliberately left untouched: an incomplete
+    response must never withdraw a previously known waterbody.
+    """
+    fetched_at = fetched_at or datetime.now(timezone.utc)
+    created = updated = 0
+    for raw in rows:
+        payload = _json_payload(raw)
+        if payload.get("source_system") != "rf4db":
+            raise CommunityImportError("waterbody catalog requires source_system=rf4db")
+        external_id = _required(payload, "source_external_id", 200)
+        name = _required(payload, "name", 200)
+        source_url = _required(payload, "source_url", 2000)
+        parsed_url = urlparse(source_url)
+        if parsed_url.scheme != "https" or parsed_url.hostname not in {"rf4db.com", "www.rf4db.com"}:
+            raise CommunityImportError("waterbody source_url does not match rf4db")
+        unlock_level = _integer(payload.get("unlock_level"), minimum=0, maximum=1_000)
+        unlock_label = _required(payload, "unlock_label", 50)
+        fish_species_count = _integer(payload.get("fish_species_count"), minimum=0, maximum=10_000)
+        if fish_species_count is None:
+            raise CommunityImportError("invalid fish_species_count")
+
+        item = session.scalar(select(Waterbody).where(
+            Waterbody.source_system == "rf4db",
+            Waterbody.source_external_id == external_id,
+        ))
+        if item is None:
+            item = session.scalar(select(Waterbody).where(Waterbody.name_ru == name))
+        if item is None:
+            item = Waterbody(
+                slug=_catalog_slug(session, name, external_id),
+                name_ru=name,
+                unlock_level=unlock_level,
+            )
+            session.add(item)
+            created += 1
+        else:
+            updated += 1
+        item.name_ru = name
+        item.unlock_level = unlock_level
+        item.fish_species_count = fish_species_count
+        item.source_system = "rf4db"
+        item.source_external_id = external_id
+        item.source_url = source_url
+        item.source_checked_at = fetched_at
+    session.commit()
+    return created, updated
+
+
+def update_waterbody_detail(
+    session: Session, detail: dict[str, Any], *, fetched_at: datetime | None = None,
+) -> bool:
+    """Persist one complete RF4DB detail snapshot without assigning media roles."""
+    fetched_at = fetched_at or datetime.now(timezone.utc)
+    payload = _validate_waterbody_detail(detail)
+    _apply_waterbody_detail(session, payload, fetched_at=fetched_at)
+    session.commit()
+    return True
+
+
+def update_waterbody_details(
+    session: Session, details: Iterable[dict[str, Any]], *, fetched_at: datetime | None = None,
+) -> tuple[int, int]:
+    """Validate and apply a detail batch in one transaction."""
+    fetched_at = fetched_at or datetime.now(timezone.utc)
+    payloads = [_validate_waterbody_detail(detail) for detail in details]
+    external_ids = [str(payload["source_external_id"]) for payload in payloads]
+    if len(external_ids) != len(set(external_ids)):
+        raise CommunityImportError("waterbody detail batch contains duplicate source identities")
+    updated = 0
+    for payload in payloads:
+        _apply_waterbody_detail(session, payload, fetched_at=fetched_at)
+        updated += 1
+    session.commit()
+    return 0, updated
+
+
+def _validate_waterbody_detail(detail: dict[str, Any]) -> dict[str, Any]:
+    payload = _json_payload(detail)
+    if payload.get("source_system") != "rf4db":
+        raise CommunityImportError("waterbody detail requires source_system=rf4db")
+    external_id = _required(payload, "source_external_id", 200)
+    source_url = _required(payload, "source_url", 2000)
+    parsed_url = urlparse(source_url)
+    if parsed_url.scheme != "https" or parsed_url.hostname not in {"rf4db.com", "www.rf4db.com", "download.rf4db.com"}:
+        raise CommunityImportError("waterbody detail source_url does not match rf4db")
+    _required(payload, "name", 200)
+    _optional(payload, "description", 20_000)
+    _string_list(payload, "aliases", 100, 200)
+    _string_list(payload, "fish_species", 10_000, 200)
+    _string_list(payload, "image_urls", 100, 2_000)
+    _string_list(payload, "point_urls", 10_000, 2_000)
+    return payload
+
+
+def _apply_waterbody_detail(session: Session, payload: dict[str, Any], *, fetched_at: datetime) -> None:
+    external_id = str(payload["source_external_id"])
+    source_url = str(payload["source_url"])
+    item = session.scalar(select(Waterbody).where(
+        Waterbody.source_system == "rf4db", Waterbody.source_external_id == external_id,
+    ))
+    if item is None:
+        raise CommunityImportError("waterbody detail has no imported catalog identity")
+    item.description = _optional(payload, "description", 20_000)
+    item.source_aliases = _string_list(payload, "aliases", 100, 200)
+    item.source_fish_species = _string_list(payload, "fish_species", 10_000, 200)
+    item.source_image_urls = _string_list(payload, "image_urls", 100, 2_000)
+    item.source_point_urls = _string_list(payload, "point_urls", 10_000, 2_000)
+    item.source_url = source_url
+    item.source_checked_at = fetched_at
+
+
+def _catalog_slug(session: Session, name: str, external_id: str) -> str:
+    base = re.sub(r"[^a-z0-9а-яё]+", "-", name.casefold(), flags=re.IGNORECASE).strip("-")
+    base = base or "waterbody"
+    candidate = base[:100]
+    if session.scalar(select(Waterbody.id).where(Waterbody.slug == candidate)) is None:
+        return candidate
+    suffix = hashlib.sha256(external_id.encode()).hexdigest()[:10]
+    return f"{base[:89]}-{suffix}"
+
+
+def _string_list(payload: dict[str, Any], key: str, max_items: int, max_length: int) -> list[str]:
+    value = payload.get(key)
+    if not isinstance(value, list) or len(value) > max_items:
+        raise CommunityImportError(f"invalid {key}")
+    result = []
+    for item in value:
+        text = str(item).strip()
+        if not text or len(text) > max_length:
+            raise CommunityImportError(f"invalid {key}")
+        result.append(text)
+    return list(dict.fromkeys(result))
+
+
 def stage_observations(
     session: Session, records: Iterable[dict[str, Any]], *, fetched_at: datetime | None = None,
 ) -> tuple[int, int]:
@@ -65,9 +208,12 @@ def stage_observations(
             "waterbody_external_id": _optional(payload, "waterbody_external_id", 200),
             "x": _integer(payload.get("x"), maximum=10_000),
             "y": _integer(payload.get("y"), maximum=10_000),
+            "coordinate_raw": _coordinate_raw(payload),
+            "coordinate_precision": _coordinate_precision(payload),
             "weight_g": _integer(payload.get("weight_g"), minimum=1, maximum=3_000_000),
             "published_at": _datetime(payload.get("published_at")),
             "last_seen_at": fetched_at, "payload": payload,
+            "source_check_status": "available", "source_checked_at": fetched_at,
         }
         if observation is None:
             observation = ExternalObservation(
@@ -82,6 +228,7 @@ def stage_observations(
             changed = any(getattr(observation, key) != values[key] for key in (
                 "source_url", "fish_name", "fish_external_id", "waterbody_name",
                 "waterbody_external_id", "x", "y", "weight_g",
+                "coordinate_raw", "coordinate_precision",
             )) or observation.payload != payload
             if observation.status != "rejected" and changed and observation.catch_report is not None:
                 observation.catch_report.moderation_status = ModerationStatus.pending
@@ -89,8 +236,17 @@ def stage_observations(
                 observation.fish = None
                 observation.waterbody = None
                 observation.review_note = "Source record changed; manual mapping and publication required"
+                observation.reviewed_at = fetched_at
+                observation.moderation_version += 1
             for key, value in values.items():
                 setattr(observation, key, value)
+            if observation.status == "withdrawn":
+                observation.status = "staged"
+                observation.fish = None
+                observation.waterbody = None
+                observation.review_note = "Source record reappeared; manual confirmation required"
+                observation.reviewed_at = fetched_at
+                observation.moderation_version += 1
             updated += 1
         touched.append(observation)
     session.commit()
@@ -176,6 +332,27 @@ def _optional(payload: dict[str, Any], key: str, limit: int) -> str | None:
     return value or None
 
 
+def _coordinate_raw(payload: dict[str, Any]) -> str | None:
+    value = str(payload.get("coordinate_raw") or "").strip()
+    if len(value) > 200:
+        raise CommunityImportError("invalid coordinate_raw")
+    if value:
+        return value
+    x, y = payload.get("x"), payload.get("y")
+    return f"{x}:{y}" if isinstance(x, int) and isinstance(y, int) else None
+
+
+def _coordinate_precision(payload: dict[str, Any]) -> str:
+    value = str(payload.get("coordinate_precision") or "").strip().casefold()
+    if not value:
+        return "exact" if isinstance(payload.get("x"), int) and isinstance(payload.get("y"), int) else "missing"
+    if value not in COORDINATE_PRECISIONS:
+        raise CommunityImportError("invalid coordinate_precision")
+    if value == "exact" and (not isinstance(payload.get("x"), int) or not isinstance(payload.get("y"), int)):
+        raise CommunityImportError("exact coordinates require x and y")
+    return value
+
+
 def _integer(value: Any, *, minimum: int = -10_000, maximum: int) -> int | None:
     if value is None:
         return None

apps/api/app/community_review.py

@@ -11,6 +11,8 @@ from .models import (
     Bait, BaitKind, CatchReport, ExternalEntityAlias, ExternalObservation,
     Fish, ModerationStatus, SourceType, Spot, Waterbody,
 )
+from .tackle_components import replace_tackle_components
+from rf4_research.gear_components import from_catch_fields
 
 
 class ExternalReviewError(ValueError):
@@ -104,6 +106,8 @@ def publish_observation(session: Session, observation: ExternalObservation) -> C
                 "external_observation_id": str(observation.id),
                 "source_system": observation.source_system,
                 "source_external_id": observation.source_external_id,
+                "coordinate_raw": observation.coordinate_raw,
+                "coordinate_precision": observation.coordinate_precision,
             },
             "original": observation.payload,
         },
@@ -116,6 +120,17 @@ def publish_observation(session: Session, observation: ExternalObservation) -> C
             setattr(report, key, value)
     session.add(report)
     session.flush()
+    replace_tackle_components(
+        session,
+        report,
+        from_catch_fields(
+            bait=observation.payload.get("bait"),
+            rig_type=observation.payload.get("rig_type"),
+        ),
+        source_system=observation.source_system,
+        source_url=observation.source_url,
+        raw_payload={"origin": "community_observation", "observation_id": str(observation.id)},
+    )
     observation.catch_report = report
     observation.status = "published"
     observation.reviewed_at = now

apps/api/app/community_scheduler.py

@@ -14,6 +14,7 @@ from .config import settings
 from .database import SessionLocal
 from .logging_config import configure_logging
 from .models import CommunityImportRun, DataSource
+from .source_lifecycle import classify_source_failure, record_scheduled_source_check
 
 logger = logging.getLogger("rf4.community_scheduler")
 MAX_BACKOFF_SECONDS = 24 * 60 * 60
@@ -102,11 +103,27 @@ def run_source(source_system: str, *, now: datetime | None = None) -> bool:
             html = fetch_html(url)
             records = parser(html, source_url=url) if source_system in {"rf4map", "rf4posts-spot"} else parser(html)
             created, updated = stage_observations(session, [asdict(item) for item in records])
+            record_scheduled_source_check(
+                session, source_system=source_system, source_url=url,
+                status="available", checked_at=current,
+            )
             run.status, run.rows_seen, run.rows_created, run.rows_updated = "success", len(records), created, updated
         except Exception as exc:
             session.rollback()
+            source_status = classify_source_failure(exc)
+            checked = datetime.now(timezone.utc)
+            affected = record_scheduled_source_check(
+                session,
+                source_system=source_system,
+                source_url=url,
+                status=source_status,
+                checked_at=checked,
+            )
             run.status, run.error_summary = "failed", f"{type(exc).__name__}: {str(exc)[:500]}"
-            logger.exception("community import failed", extra={"event":"community_import_failed", "source_system":source_system})
+            logger.exception("community import failed", extra={
+                "event":"community_import_failed", "source_system":source_system,
+                "source_check_status": source_status, "affected_observations": affected,
+            })
         run.finished_at = datetime.now(timezone.utc); session.commit()
         return True
 

apps/api/app/config.py

@@ -31,6 +31,8 @@ class Settings(BaseSettings):
     rf4map_point_url: str = "https://rf4map.ru/points/275"
     rf4posts_spot_url: str = "https://rf4-posts.com/ru/spots/d0c6d9c6-4ebf-49a7-98a8-9a562553a8ee"
     rate_limit_secret: str = "change-rate-limit-secret"
+    admin_auth_attempt_limit: int = Field(default=10, ge=3, le=100)
+    admin_auth_window_seconds: int = Field(default=600, ge=60, le=3600)
     log_level: str = "INFO"
     cors_origins: list[str] = Field(default_factory=lambda: ["http://localhost:4321", "http://127.0.0.1:4321"])
     trusted_proxy_cidrs: list[str] = Field(default_factory=lambda: ["127.0.0.1/32", "::1/128"])

apps/api/app/dependencies.py

@@ -0,0 +1,8 @@
+from typing import Annotated
+
+from fastapi import Depends
+from sqlalchemy.orm import Session
+
+from .database import get_session
+
+Db = Annotated[Session, Depends(get_session)]

apps/api/app/importer.py

@@ -16,6 +16,8 @@ from .models import (
     Bait, BaitKind, CatchReport, Fish, ImportRecordEvent, ImportStatus, ModerationStatus,
     OfficialRecordImport, SourceType, Waterbody,
 )
+from .tackle_components import replace_tackle_components
+from rf4_research.gear_components import from_catch_fields
 
 
 USER_AGENT = "RF4-Spotter/0.1 (public records importer)"
@@ -222,6 +224,14 @@ def _import_records_locked(session: Session, *, url: str, region: str, category:
                         provenance={"source_system": "rf4-official", "source_url": url, "source_external_id": key},
                     ))
                     run.rows_updated += 1
+            replace_tackle_components(
+                session,
+                report,
+                from_catch_fields(bait=raw.bait, rig_type=None),
+                source_system="rf4-official",
+                source_url=url,
+                raw_payload={"origin": "official_record", "source_external_id": key},
+            )
         run.status = ImportStatus.success
         run.finished_at = datetime.now(timezone.utc)
         session.commit()

apps/api/app/main.py

@@ -1,37 +1,28 @@
 from __future__ import annotations
 
-from collections import Counter
-from datetime import datetime, timedelta, timezone
-from ipaddress import IPv4Address, IPv6Address, IPv4Network, IPv6Network
-import hashlib
-import hmac
-import json
 import logging
-import secrets
 import time as time_module
-from typing import Annotated, Literal
-from uuid import UUID
 import uuid
 
-import httpx
-from fastapi import Depends, FastAPI, File, Header, HTTPException, Query, Request, Response, UploadFile
+from fastapi import FastAPI, Request
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import JSONResponse
-from sqlalchemy import delete, func, select, text
-from sqlalchemy.exc import IntegrityError
-from sqlalchemy.orm import Session, joinedload
+from sqlalchemy.orm import Session
 
-from .activity import activity_rows
-from .database import get_session
 from .config import settings
-from .community_review import ExternalReviewError, map_observation, publish_observation, reject_observation, suggest_aliases
-from .importer import ImportAlreadyRunning, ImportSourceError, import_records, normalize
+from .dependencies import Db
 from .logging_config import configure_logging
-from .models import Bait, BaitKind, CatchReport, CommunityImportRun, DataSource, ExternalObservation, Fish, ModerationEvent, ModerationStatus, OfficialRecordImport, SourceType, Spot, SubmissionAttempt, Waterbody
 from .readiness import readiness_report
-from .public_cache import public_cache
-from .schemas import ActivityOut, AdminCatchReportOut, BaitOut, CatchOut, CatchReportAccepted, CatchReportCreate, CatchReportCreated, ExternalAliasSuggestionOut, ExternalObservationDecision, ExternalObservationMapping, ExternalObservationOut, ExternalObservationPublished, FishOut, ImportRunOut, ImportRunPublicOut, ModerationUpdate, OfficialRecordOut, PaginatedActivityOut, PaginatedOfficialRecordOut, PublicObservationOut, SourceStatusOut, SpotOut, WaterbodyOut
-from .storage import ScreenshotError, client as storage_client, delete_screenshot, signed_screenshot_url, upload_screenshot
+from .routers.activity import router as activity_router
+from .routers.analytics import router as analytics_router
+from .routers.admin import router as admin_router
+from .routers.catalog import router as catalog_router
+from .routers.media import router as media_router
+from .routers.public_data import router as public_data_router
+from .routers.submissions import router as submissions_router
+from .storage import client as storage_client
+from .submission_security import check_rate_limit
+from .submission_security import is_trusted_proxy as _is_trusted_proxy
 
 
 configure_logging(settings.log_level)
@@ -43,7 +34,6 @@ app.add_middleware(
     allow_methods=["GET", "POST", "PATCH", "DELETE"],
     allow_headers=["Authorization", "Content-Type"],
 )
-Db = Annotated[Session, Depends(get_session)]
 
 
 @app.middleware("http")
@@ -98,541 +88,14 @@ def ready(db: Db) -> JSONResponse:
     )
 
 
-@app.get("/api/v1/fishes", response_model=list[FishOut])
-def fishes(db: Db, limit: int = Query(200, ge=1, le=500), offset: int = Query(0, ge=0)) -> list[Fish]:
-    return list(db.scalars(select(Fish).order_by(Fish.name_ru, Fish.id).offset(offset).limit(limit)))
-
-
-@app.get("/api/v1/waterbodies", response_model=list[WaterbodyOut])
-def waterbodies(db: Db, limit: int = Query(200, ge=1, le=500), offset: int = Query(0, ge=0)) -> list[Waterbody]:
-    return list(db.scalars(select(Waterbody).order_by(Waterbody.name_ru, Waterbody.id).offset(offset).limit(limit)))
-
-
-@app.get("/api/v1/baits", response_model=list[BaitOut])
-def baits(db: Db, limit: int = Query(200, ge=1, le=500), offset: int = Query(0, ge=0)) -> list[Bait]:
-    return list(db.scalars(select(Bait).order_by(Bait.name, Bait.id).offset(offset).limit(limit)))
-
-
-@app.get("/api/v1/public-spot-pages")
-def public_spot_pages(db: Db, limit: int = Query(500, ge=1, le=500), offset: int = Query(0, ge=0)) -> list[str]:
-    rows = db.execute(select(Waterbody.slug, Spot.x, Spot.y, Fish.slug)
-        .select_from(CatchReport).join(Spot, CatchReport.spot_id == Spot.id)
-        .join(Waterbody, Spot.waterbody_id == Waterbody.id).join(Fish, CatchReport.fish_id == Fish.id)
-        .where(CatchReport.moderation_status == ModerationStatus.approved, CatchReport.deleted_at.is_(None))
-        .distinct().order_by(Waterbody.slug, Spot.x, Spot.y, Fish.slug).offset(offset).limit(limit))
-    return [path for water, x, y, fish in rows for path in
-        (f"/spots/{water}-{x}x{y}", f"/waterbodies/{water}/{fish}")]
-
-
-@app.get("/api/v1/activity", response_model=PaginatedActivityOut)
-def activity(
-    db: Db, response: Response, hours: int = Query(24),
-    waterbody: str | None = None, fish: str | None = None,
-    method: str | None = None,
-    sort: Literal["activity", "confidence", "freshness"] = "activity",
-    limit: int = Query(20, ge=1, le=100), offset: int = Query(0, ge=0),
-) -> PaginatedActivityOut:
-    if hours not in {6, 12, 24, 72}:
-        raise HTTPException(status_code=422, detail="hours must be one of: 6, 12, 24, 72")
-    response.headers["Cache-Control"] = "no-store"
-    generation = public_cache.generation()
-    cache_key = ("activity", hours, waterbody, fish, method, sort, limit, offset)
-    cached = public_cache.get(cache_key, settings.public_cache_seconds)
-    if cached is not None:
-        response.headers["X-Cache"] = "HIT"
-        return cached
-    rows = activity_rows(db, hours=hours, waterbody=waterbody, fish=fish, method=method)
-    total = len(rows)
-    keys = {
-        "activity": lambda r: (r.activity_score, r.confidence_score, r.last_confirmed_at, str(r.spot_id)),
-        "confidence": lambda r: (r.confidence_score, r.activity_score, r.last_confirmed_at, str(r.spot_id)),
-        "freshness": lambda r: (r.last_confirmed_at, r.activity_score, r.confidence_score, str(r.spot_id)),
-    }
-    rows.sort(key=keys[sort], reverse=True)
-    page = rows[offset:offset + limit]
-    response.headers["X-Cache"] = "MISS"
-    return public_cache.set(cache_key, PaginatedActivityOut(items=page, total=total, limit=limit, offset=offset), generation=generation)
-
-
-def _spot_or_404(db: Session, spot_id: UUID) -> Spot:
-    spot = db.scalar(select(Spot).options(joinedload(Spot.waterbody)).where(Spot.id == spot_id))
-    if spot is None:
-        raise HTTPException(status_code=404, detail="spot not found")
-    return spot
-
-
-@app.get("/api/v1/spots/resolve", response_model=SpotOut)
-def resolve_spot(
-    db: Db, waterbody: str, x: int = Query(ge=-10_000, le=10_000),
-    y: int = Query(ge=-10_000, le=10_000),
-) -> SpotOut:
-    spot = db.scalar(select(Spot).options(joinedload(Spot.waterbody)).join(Spot.waterbody).where(
-        Waterbody.slug == waterbody, Spot.x == x, Spot.y == y,
-    ))
-    if spot is None:
-        raise HTTPException(status_code=404, detail="spot not found")
-    return spot_detail(spot.id, db)
-
-
-@app.get("/api/v1/spots/{spot_id}", response_model=SpotOut)
-def spot_detail(spot_id: UUID, db: Db) -> SpotOut:
-    spot = _spot_or_404(db, spot_id)
-    reports = list(db.scalars(select(CatchReport).options(joinedload(CatchReport.bait)).where(CatchReport.spot_id == spot.id, CatchReport.moderation_status == ModerationStatus.approved, CatchReport.deleted_at.is_(None))))
-    now = datetime.now(timezone.utc)
-    def count_since(delta: timedelta) -> int:
-        return sum(_aware(r.reported_at) >= now - delta for r in reports)
-    bait_counts = Counter(r.bait.name for r in reports if r.bait)
-    return SpotOut(id=spot.id, waterbody_slug=spot.waterbody.slug, waterbody=spot.waterbody.name_ru, x=spot.x, y=spot.y, description=spot.description, catches_24h=count_since(timedelta(hours=24)), catches_3d=count_since(timedelta(days=3)), catches_7d=count_since(timedelta(days=7)), top_baits=[name for name, _ in bait_counts.most_common(5)])
-
-
-@app.get("/api/v1/spots/{spot_id}/catches", response_model=list[CatchOut])
-def spot_catches(spot_id: UUID, db: Db, limit: int = Query(50, ge=1, le=100), offset: int = Query(0, ge=0)) -> list[CatchOut]:
-    _spot_or_404(db, spot_id)
-    reports = list(db.scalars(select(CatchReport).options(joinedload(CatchReport.fish), joinedload(CatchReport.bait)).where(CatchReport.spot_id == spot_id, CatchReport.moderation_status == ModerationStatus.approved, CatchReport.deleted_at.is_(None)).order_by(CatchReport.reported_at.desc(), CatchReport.id.desc()).offset(offset).limit(limit)))
-    return [CatchOut(id=r.id, fish=r.fish.name_ru, weight_g=r.weight_g, bait=r.bait.name if r.bait else None, player_name=r.player_name, caught_at=r.caught_at, reported_at=r.reported_at, retrieve_method=r.retrieve_method, retrieve_speed=r.retrieve_speed, source_system=_report_source(r), source_url=r.source_url) for r in reports]
-
-
-@app.get("/api/v1/spots/{spot_id}/timeline")
-def spot_timeline(spot_id: UUID, db: Db) -> list[dict]:
-    _spot_or_404(db, spot_id)
-    now = datetime.now(timezone.utc)
-    buckets = []
-    for index in range(6):
-        start = now - timedelta(hours=(6 - index) * 12)
-        end = start + timedelta(hours=12)
-        count = db.scalar(select(func.count()).select_from(CatchReport).where(
-            CatchReport.spot_id == spot_id,
-            CatchReport.moderation_status == ModerationStatus.approved,
-            CatchReport.deleted_at.is_(None),
-            CatchReport.reported_at >= start, CatchReport.reported_at < end,
-        )) or 0
-        buckets.append({"start": start.isoformat(), "end": end.isoformat(), "count": count})
-    return buckets
-
-
-def _report_source(report: CatchReport) -> str:
-    provenance = (report.raw_payload or {}).get("provenance", {})
-    if isinstance(provenance, dict) and provenance.get("source_system"):
-        return str(provenance["source_system"])
-    if report.source_type == SourceType.official_record:
-        return "rf4-official"
-    if report.source_type == SourceType.user:
-        return "players"
-    return "manual-import"
-
-
-@app.get("/api/v1/community-observations", response_model=list[PublicObservationOut])
-def community_observations(
-    db: Db, limit: int = Query(12, ge=1, le=50), offset: int = Query(0, ge=0),
-    waterbody: str | None = None, fish: str | None = None,
-) -> list[PublicObservationOut]:
-    query = select(ExternalObservation).join(ExternalObservation.source).options(joinedload(ExternalObservation.source)).where(
-        ExternalObservation.catch_report_id.is_(None),
-        ExternalObservation.status != "rejected",
-        DataSource.enabled.is_(True),
-    )
-    if waterbody:
-        query = query.join(ExternalObservation.waterbody).where(Waterbody.slug == waterbody)
-    if fish:
-        query = query.join(ExternalObservation.fish).where(Fish.slug == fish)
-    items = list(db.scalars(query.order_by(ExternalObservation.last_seen_at.desc(), ExternalObservation.id.desc()).offset(offset).limit(limit)))
-    result: list[PublicObservationOut] = []
-    for item in items:
-        missing = []
-        if item.x is None or item.y is None:
-            missing.append("координаты")
-        if item.weight_g is None:
-            missing.append("вес")
-        result.append(PublicObservationOut(
-            id=item.id, source_system=item.source_system, source_name=item.source.name,
-            source_url=item.source_url, fish_name=item.fish_name, waterbody_name=item.waterbody_name,
-            x=item.x, y=item.y, weight_g=item.weight_g, last_seen_at=item.last_seen_at,
-            missing_fields=missing, quality="incomplete" if missing else "unverified",
-        ))
-    return result
-
-
-@app.get("/api/v1/source-status", response_model=list[SourceStatusOut])
-def source_status(db: Db) -> list[SourceStatusOut]:
-    now = datetime.now(timezone.utc)
-    result = []
-    for source in db.scalars(select(DataSource).order_by(DataSource.name)):
-        runs = list(db.scalars(select(CommunityImportRun).where(CommunityImportRun.source_system == source.key).order_by(CommunityImportRun.started_at.desc()).limit(20)))
-        latest = runs[0] if runs else None
-        success = next((run for run in runs if run.status == "success"), None)
-        if not source.enabled:
-            state = "disabled"
-        elif latest is None:
-            state = "waiting"
-        elif latest.status == "failed":
-            state = "source_changed" if "CommunityParseError" in (latest.error_summary or "") else "temporarily_limited"
-        elif _aware(latest.started_at) < now - timedelta(seconds=settings.community_import_interval_seconds * 2):
-            state = "stale"
-        else:
-            state = "healthy"
-        result.append(SourceStatusOut(source_system=source.key, name=source.name, status=state,
-            last_started_at=latest.started_at if latest else None, last_success_at=success.started_at if success else None,
-            observations=db.scalar(select(func.count()).select_from(ExternalObservation).where(ExternalObservation.source_system == source.key)) or 0))
-    return result
-
-
-@app.get("/api/v1/records", response_model=PaginatedOfficialRecordOut)
-def records(
-    db: Db, fish: str | None = None, waterbody: str | None = None,
-    category: str | None = None, limit: int = Query(50, ge=1, le=100),
-    offset: int = Query(0, ge=0),
-) -> PaginatedOfficialRecordOut:
-    query = select(CatchReport).options(joinedload(CatchReport.fish), joinedload(CatchReport.waterbody), joinedload(CatchReport.bait)).where(CatchReport.source_type == SourceType.official_record)
-    if fish:
-        query = query.join(CatchReport.fish).where(Fish.slug == fish)
-    if waterbody:
-        query = query.join(CatchReport.waterbody).where(Waterbody.slug == waterbody)
-    if category:
-        query = query.where(CatchReport.raw_payload["category"].as_string() == category)
-    # Count from the exact same filtered query (before pagination).
-    count_query = query.with_only_columns(func.count(CatchReport.id), maintain_column_froms=True).order_by(None)
-    total = db.scalar(count_query) or 0
-    items = list(db.scalars(query.order_by(CatchReport.caught_at.desc(), CatchReport.weight_g.desc(), CatchReport.id.desc()).offset(offset).limit(limit)))
-    return PaginatedOfficialRecordOut(
-        items=[OfficialRecordOut(id=r.id, fish=r.fish.name_ru, weight_g=r.weight_g, waterbody=r.waterbody.name_ru, bait=r.bait.name if r.bait else None, player_name=r.player_name, record_date=r.caught_at, category=(r.raw_payload or {}).get("category"), region=(r.raw_payload or {}).get("region"), source_url=r.source_url) for r in items],
-        total=total, limit=limit, offset=offset,
-    )
-
-
-def _admin(authorization: Annotated[str | None, Header()] = None) -> str:
-    expected = f"Bearer {settings.admin_token}"
-    if not authorization or not hmac.compare_digest(authorization, expected):
-        raise HTTPException(status_code=401, detail="invalid admin token", headers={"WWW-Authenticate": "Bearer"})
-    return "admin"
-
-
-@app.get("/api/v1/admin/diagnostics")
-def admin_diagnostics(db: Db, _: Annotated[str, Depends(_admin)]) -> JSONResponse:
-    report_counts = {status.value: count for status, count in db.execute(
-        select(CatchReport.moderation_status, func.count()).group_by(CatchReport.moderation_status)
-    )}
-    observation_counts = {status: count for status, count in db.execute(
-        select(ExternalObservation.status, func.count()).group_by(ExternalObservation.status)
-    )}
-    payload = {
-        "generated_at": datetime.now(timezone.utc).isoformat(),
-        "build": {"version": settings.app_version, "revision": settings.app_revision, "environment": settings.deployment_environment},
-        "counts": {
-            "catch_reports": report_counts,
-            "external_observations": observation_counts,
-            "data_sources": db.scalar(select(func.count()).select_from(DataSource)) or 0,
-            "enabled_data_sources": db.scalar(select(func.count()).select_from(DataSource).where(DataSource.enabled.is_(True))) or 0,
-            "official_import_runs": db.scalar(select(func.count()).select_from(OfficialRecordImport)) or 0,
-            "community_import_runs": db.scalar(select(func.count()).select_from(CommunityImportRun)) or 0,
-        },
-    }
-    return JSONResponse(payload, headers={"Content-Disposition": "attachment; filename=rf4spotter-diagnostics.json"})
-
-
-@app.get("/api/v1/imports", response_model=list[ImportRunPublicOut])
-def imports(db: Db, limit: int = Query(20, ge=1, le=100), offset: int = Query(0, ge=0)) -> list[OfficialRecordImport]:
-    return list(db.scalars(select(OfficialRecordImport).order_by(OfficialRecordImport.started_at.desc(), OfficialRecordImport.id.desc()).offset(offset).limit(limit)))
-
-
-@app.get("/api/v1/admin/imports", response_model=list[ImportRunOut])
-def admin_imports(
-    db: Db,
-    _: Annotated[str, Depends(_admin)],
-    limit: int = Query(20, ge=1, le=100),
-    offset: int = Query(0, ge=0),
-) -> list[OfficialRecordImport]:
-    query = select(OfficialRecordImport).order_by(
-        OfficialRecordImport.started_at.desc(), OfficialRecordImport.id.desc()
-    ).offset(offset).limit(limit)
-    return list(db.scalars(query))
-
-
-@app.post("/api/v1/admin/imports/official-records", response_model=ImportRunOut, status_code=201)
-def admin_start_official_import(db: Db, _: Annotated[str, Depends(_admin)]) -> OfficialRecordImport:
-    try:
-        return import_records(
-            db,
-            url=settings.official_records_url,
-            region=settings.official_records_region,
-            category=settings.official_records_category,
-        )
-    except ImportAlreadyRunning as exc:
-        raise HTTPException(status_code=409, detail=str(exc)) from exc
-    except (ImportSourceError, httpx.HTTPError) as exc:
-        raise HTTPException(status_code=502, detail=f"official records import failed: {exc}") from exc
-
-
-def _external_out(item: ExternalObservation) -> ExternalObservationOut:
-    return ExternalObservationOut(
-        id=item.id, source_system=item.source_system, source_external_id=item.source_external_id,
-        source_url=item.source_url, fish_name=item.fish_name, fish_external_id=item.fish_external_id,
-        waterbody_name=item.waterbody_name, waterbody_external_id=item.waterbody_external_id,
-        x=item.x, y=item.y, weight_g=item.weight_g, published_at=item.published_at,
-        last_seen_at=item.last_seen_at, status=item.status,
-        fish_slug=item.fish.slug if item.fish else None,
-        waterbody_slug=item.waterbody.slug if item.waterbody else None,
-        catch_report_id=item.catch_report_id, review_note=item.review_note,
-    )
-
-
-@app.get("/api/v1/admin/external-observations", response_model=list[ExternalObservationOut])
-def admin_external_observations(
-    db: Db, _: Annotated[str, Depends(_admin)],
-    status: Literal["staged", "mapped", "ready", "published", "rejected", "review"] | None = None,
-    source_system: str | None = None, limit: int = Query(50, ge=1, le=200), offset: int = Query(0, ge=0),
-) -> list[ExternalObservationOut]:
-    query = select(ExternalObservation).options(
-        joinedload(ExternalObservation.fish), joinedload(ExternalObservation.waterbody),
-    )
-    if status == "review":
-        query = query.where(ExternalObservation.status.in_(["staged", "mapped", "ready"]))
-    elif status:
-        query = query.where(ExternalObservation.status == status)
-    if source_system:
-        query = query.where(ExternalObservation.source_system == source_system)
-    items = db.scalars(query.order_by(ExternalObservation.last_seen_at.desc(), ExternalObservation.id.desc()).offset(offset).limit(limit))
-    return [_external_out(item) for item in items]
-
-
-@app.get("/api/v1/admin/external-observations/{observation_id}/alias-suggestions", response_model=ExternalAliasSuggestionOut)
-def admin_external_alias_suggestions(
-    observation_id: UUID, db: Db, _: Annotated[str, Depends(_admin)],
-) -> ExternalAliasSuggestionOut:
-    observation = db.get(ExternalObservation, observation_id)
-    if observation is None:
-        raise HTTPException(status_code=404, detail="external observation not found")
-    fish, waterbody = suggest_aliases(db, observation)
-    return ExternalAliasSuggestionOut(
-        fish_slug=fish.slug if fish else None,
-        waterbody_slug=waterbody.slug if waterbody else None,
-    )
-
-
-@app.patch("/api/v1/admin/external-observations/{observation_id}/mapping", response_model=ExternalObservationOut)
-def admin_map_external_observation(
-    observation_id: UUID, payload: ExternalObservationMapping, db: Db,
-    _: Annotated[str, Depends(_admin)],
-) -> ExternalObservationOut:
-    observation = db.get(ExternalObservation, observation_id)
-    fish = db.scalar(select(Fish).where(Fish.slug == payload.fish_slug))
-    waterbody = db.scalar(select(Waterbody).where(Waterbody.slug == payload.waterbody_slug))
-    if observation is None:
-        raise HTTPException(status_code=404, detail="external observation not found")
-    if fish is None or waterbody is None:
-        raise HTTPException(status_code=422, detail="unknown fish or waterbody")
-    try:
-        return _external_out(map_observation(db, observation, fish, waterbody, note=payload.note))
-    except ExternalReviewError as exc:
-        raise HTTPException(status_code=409, detail=str(exc)) from exc
-
-
-@app.post("/api/v1/admin/external-observations/{observation_id}/publish", response_model=ExternalObservationPublished)
-def admin_publish_external_observation(
-    observation_id: UUID, db: Db, _: Annotated[str, Depends(_admin)],
-) -> ExternalObservationPublished:
-    observation = db.get(ExternalObservation, observation_id)
-    if observation is None:
-        raise HTTPException(status_code=404, detail="external observation not found")
-    try:
-        report = publish_observation(db, observation)
-    except ExternalReviewError as exc:
-        raise HTTPException(status_code=409, detail=str(exc)) from exc
-    public_cache.invalidate()
-    return ExternalObservationPublished(observation_id=observation.id, catch_report_id=report.id, status=observation.status)
-
-
-@app.patch("/api/v1/admin/external-observations/{observation_id}/reject", response_model=ExternalObservationOut)
-def admin_reject_external_observation(
-    observation_id: UUID, payload: ExternalObservationDecision, db: Db,
-    _: Annotated[str, Depends(_admin)],
-) -> ExternalObservationOut:
-    observation = db.get(ExternalObservation, observation_id)
-    if observation is None:
-        raise HTTPException(status_code=404, detail="external observation not found")
-    try:
-        return _external_out(reject_observation(db, observation, reason=payload.reason))
-    except ExternalReviewError as exc:
-        raise HTTPException(status_code=409, detail=str(exc)) from exc
-
-
-@app.post("/api/v1/catch-reports", response_model=CatchReportAccepted, status_code=201)
-def create_catch_report(
-    payload: CatchReportCreate, request: Request, db: Db,
-    idempotency_key: Annotated[str | None, Header()] = None,
-) -> CatchReportAccepted:
-    if payload.website:
-        raise HTTPException(status_code=400, detail="invalid submission")
-    payload_hash = hashlib.sha256(json.dumps(payload.model_dump(mode="json"), sort_keys=True, separators=(",", ":")).encode()).hexdigest()
-    # A05: Server-side idempotency — check BEFORE rate limit to avoid polluting table
-    if idempotency_key:
-        key_hash = hmac.new(settings.rate_limit_secret.encode(), idempotency_key.encode(), hashlib.sha256).hexdigest()
-        cutoff = datetime.now(timezone.utc) - timedelta(minutes=5)
-        # Force refresh from database to see committed data from previous requests
-        db.expire_all()
-        existing = db.scalar(
-            select(SubmissionAttempt).where(
-                SubmissionAttempt.idempotency_key == key_hash,
-                SubmissionAttempt.created_at >= cutoff,
-            )
-        )
-        if existing is not None:
-            # Return 200 with idempotent flag — client can retry safely
-            logger.info("idempotent hit", extra={"idempotency_key": idempotency_key[:8]})
-            report = existing.catch_report
-            if existing.payload_hash and not hmac.compare_digest(existing.payload_hash, payload_hash):
-                raise HTTPException(status_code=409, detail="Idempotency-Key was already used with different payload")
-            if report is None:
-                raise HTTPException(status_code=409, detail="idempotency record is incomplete; retry with a new key")
-            # Re-derive the one-time upload token from the idempotency key;
-            # only its hash is persisted, so the secret is never stored.
-            replay_token = hmac.new(settings.rate_limit_secret.encode(), (key_hash + ":upload").encode(), hashlib.sha256).hexdigest()
-            if not hmac.compare_digest(hashlib.sha256(replay_token.encode()).hexdigest(), report.screenshot_upload_token_hash or ""):
-                raise HTTPException(status_code=409, detail="idempotency record token mismatch; retry with a new key")
-            return JSONResponse(status_code=200, content={"id": str(report.id), "moderation_status": report.moderation_status.value, "screenshot_upload_token": replay_token, "idempotent": True})
-        logger.info("idempotency check miss", extra={"idempotency_key": idempotency_key[:8]})
-    _check_rate_limit(request, db)
-    fish = db.scalar(select(Fish).where(Fish.slug == payload.fish_slug))
-    waterbody = db.scalar(select(Waterbody).where(Waterbody.slug == payload.waterbody_slug))
-    if fish is None or waterbody is None:
-        raise HTTPException(status_code=422, detail="unknown fish or waterbody")
-    spot = db.scalar(select(Spot).where(Spot.waterbody_id == waterbody.id, Spot.x == payload.x, Spot.y == payload.y))
-    if spot is None:
-        spot = Spot(waterbody=waterbody, x=payload.x, y=payload.y)
-        db.add(spot)
-    bait = None
-    if payload.bait_name and payload.bait_name.strip():
-        key = normalize(payload.bait_name)
-        bait = db.scalar(select(Bait).where(Bait.normalized_name == key))
-        if bait is None:
-            bait = Bait(name=payload.bait_name.strip(), normalized_name=key, kind=BaitKind.unknown)
-            db.add(bait)
-    upload_token = (hmac.new(settings.rate_limit_secret.encode(), (key_hash + ":upload").encode(), hashlib.sha256).hexdigest()
-                    if idempotency_key else secrets.token_urlsafe(32))
-    report = CatchReport(fish=fish, spot=spot, waterbody=waterbody, bait=bait, weight_g=payload.weight_g, fishing_method=payload.fishing_method, rig_type=payload.rig_type, retrieve_method=payload.retrieve_method, retrieve_speed=payload.retrieve_speed, caught_at=payload.caught_at, reported_at=datetime.now(timezone.utc), player_name=payload.player_name, source_type=SourceType.user, source_url=payload.source_url, source_confidence=60, moderation_status=ModerationStatus.pending, raw_payload={"comment": payload.comment} if payload.comment else None, screenshot_upload_token_hash=hashlib.sha256(upload_token.encode()).hexdigest())
-    db.add(report)
-    # Store idempotency key if provided
-    if idempotency_key:
-        key_hash = hmac.new(settings.rate_limit_secret.encode(), idempotency_key.encode(), hashlib.sha256).hexdigest()
-        # One transaction: a unique-key race must roll back the report too.
-        db.add(SubmissionAttempt(client_hash="", idempotency_key=key_hash, catch_report=report, payload_hash=payload_hash, created_at=datetime.now(timezone.utc)))
-        try:
-            db.commit()
-        except IntegrityError:
-            # Another request won the same idempotency key race.
-            db.rollback()
-            winner = db.scalar(select(SubmissionAttempt).where(SubmissionAttempt.idempotency_key == key_hash))
-            if winner and winner.catch_report:
-                replay_token = hmac.new(settings.rate_limit_secret.encode(), (key_hash + ":upload").encode(), hashlib.sha256).hexdigest()
-                return JSONResponse(status_code=200, content={"id": str(winner.catch_report.id), "moderation_status": winner.catch_report.moderation_status.value, "screenshot_upload_token": replay_token, "idempotent": True})
-            raise
-        logger.info("idempotency key stored", extra={"idempotency_key": idempotency_key[:8]})
-    else:
-        db.commit()
-    return CatchReportAccepted(id=report.id, moderation_status=report.moderation_status.value, screenshot_upload_token=upload_token, idempotent=False)
-
-
-@app.post("/api/v1/catch-reports/{report_id}/screenshot", status_code=204, response_class=Response)
-def add_screenshot(
-    report_id: UUID, db: Db, screenshot: UploadFile = File(),
-    upload_token: Annotated[str | None, Header(alias="X-Upload-Token")] = None,
-) -> Response:
-    report = db.get(CatchReport, report_id)
-    if report is None or report.source_type != SourceType.user or report.moderation_status != ModerationStatus.pending:
-        raise HTTPException(status_code=404, detail="pending catch report not found")
-    supplied_hash = hashlib.sha256((upload_token or "").encode()).hexdigest()
-    if not report.screenshot_upload_token_hash or not hmac.compare_digest(report.screenshot_upload_token_hash, supplied_hash):
-        raise HTTPException(status_code=401, detail="invalid screenshot upload token")
-    if report.screenshot_key:
-        raise HTTPException(status_code=409, detail="screenshot already uploaded")
-    raw = screenshot.file.read(settings.screenshot_max_bytes + 1)
-    try:
-        report.screenshot_key = upload_screenshot(raw, filename=screenshot.filename, content_type=screenshot.content_type)
-    except ScreenshotError as exc:
-        raise HTTPException(status_code=422, detail=str(exc)) from exc
-    report.screenshot_upload_token_hash = None
-    db.commit()
-    return Response(status_code=204)
-
-
-@app.get("/api/v1/admin/catch-reports", response_model=list[AdminCatchReportOut])
-def admin_reports(db: Db, _: Annotated[str, Depends(_admin)], status: ModerationStatus = ModerationStatus.pending, limit: int = Query(50, ge=1, le=100), offset: int = Query(0, ge=0)) -> list[AdminCatchReportOut]:
-    reports = list(db.scalars(select(CatchReport).options(joinedload(CatchReport.fish), joinedload(CatchReport.waterbody), joinedload(CatchReport.spot), joinedload(CatchReport.bait)).where(CatchReport.source_type == SourceType.user, CatchReport.moderation_status == status, CatchReport.deleted_at.is_(None)).order_by(CatchReport.reported_at, CatchReport.id).offset(offset).limit(limit)))
-    return [AdminCatchReportOut(id=r.id, fish=r.fish.name_ru, waterbody=r.waterbody.name_ru, coordinates=f"{r.spot.x}:{r.spot.y}" if r.spot else "—", weight_g=r.weight_g, bait=r.bait.name if r.bait else None, player_name=r.player_name, reported_at=r.reported_at, moderation_status=r.moderation_status.value, comment=(r.raw_payload or {}).get("comment"), screenshot_url=signed_screenshot_url(r.screenshot_key) if r.screenshot_key else None) for r in reports]
-
-
-@app.patch("/api/v1/admin/catch-reports/{report_id}", response_model=CatchReportCreated)
-def moderate_report(report_id: UUID, payload: ModerationUpdate, db: Db, moderator: Annotated[str, Depends(_admin)]) -> CatchReportCreated:
-    report = db.get(CatchReport, report_id)
-    if report is None or report.source_type != SourceType.user or report.deleted_at is not None:
-        raise HTTPException(status_code=404, detail="catch report not found")
-    previous = report.moderation_status
-    report.moderation_status = ModerationStatus(payload.status)
-    db.add(ModerationEvent(catch_report=report, created_at=datetime.now(timezone.utc), previous_status=previous, new_status=report.moderation_status, moderator=moderator, reason=payload.reason))
-    db.commit()
-    public_cache.invalidate()
-    return CatchReportCreated(id=report.id, moderation_status=report.moderation_status.value)
-
-
-@app.delete("/api/v1/admin/catch-reports/{report_id}", status_code=204, response_class=Response)
-def delete_report(report_id: UUID, db: Db, moderator: Annotated[str, Depends(_admin)]) -> Response:
-    report = db.get(CatchReport, report_id)
-    if report is None or report.source_type != SourceType.user or report.deleted_at is not None:
-        raise HTTPException(status_code=404, detail="catch report not found")
-    previous = report.moderation_status
-    if report.screenshot_key:
-        try:
-            delete_screenshot(report.screenshot_key)
-        except Exception as exc:
-            raise HTTPException(status_code=502, detail="screenshot deletion failed") from exc
-    report.moderation_status = ModerationStatus.rejected
-    report.deleted_at = datetime.now(timezone.utc)
-    report.player_name = None
-    report.source_url = None
-    report.screenshot_key = None
-    report.raw_payload = None
-    db.add(ModerationEvent(catch_report=report, created_at=report.deleted_at, previous_status=previous, new_status=ModerationStatus.rejected, moderator=moderator, reason="user report deleted and anonymized"))
-    db.commit()
-    public_cache.invalidate()
-    return Response(status_code=204)
-
-
-def _is_trusted_proxy(address: str, trusted_cidrs: list[str]) -> bool:
-    """Check if address is in trusted proxy CIDRs."""
-    try:
-        addr = IPv4Address(address) if ":" not in address else IPv6Address(address)
-    except ValueError:
-        return False
-    for cidr in trusted_cidrs:
-        try:
-            network = IPv4Network(cidr) if ":" not in cidr else IPv6Network(cidr)
-            if addr in network:
-                return True
-        except ValueError:
-            continue
-    return False
+app.include_router(catalog_router)
+app.include_router(media_router)
+app.include_router(activity_router)
+app.include_router(analytics_router)
+app.include_router(public_data_router)
+app.include_router(admin_router)
+app.include_router(submissions_router)
 
 
 def _check_rate_limit(request: Request, db: Session) -> None:
-    now = datetime.now(timezone.utc)
-    cutoff = now - timedelta(minutes=10)
-    # Extract real client IP from forwarded headers
-    client = request.client.host if request.client else "unknown"
-    forwarded = request.headers.get("x-forwarded-for")
-    # Only trust X-Forwarded-For if connection came from a trusted proxy
-    if forwarded and request.client and _is_trusted_proxy(request.client.host, settings.trusted_proxy_cidrs):
-        client = forwarded.split(",")[0].strip()
-    client_hash = hmac.new(settings.rate_limit_secret.encode(), client.encode(), hashlib.sha256).hexdigest()
-    if db.get_bind().dialect.name == "postgresql":
-        lock_key = int(client_hash[:16], 16) & 0x7FFF_FFFF_FFFF_FFFF
-        db.execute(text("SELECT pg_advisory_xact_lock(:lock_key)"), {"lock_key": lock_key})
-    db.execute(delete(SubmissionAttempt).where(SubmissionAttempt.created_at < now - timedelta(days=1)))
-    recent = db.scalar(select(func.count()).select_from(SubmissionAttempt).where(SubmissionAttempt.client_hash == client_hash, SubmissionAttempt.created_at >= cutoff)) or 0
-    if recent >= 5:
-        db.commit()
-        raise HTTPException(status_code=429, detail="too many submissions")
-    db.add(SubmissionAttempt(client_hash=client_hash, created_at=now))
-    db.commit()
-
-
-def _aware(value: datetime) -> datetime:
-    return value if value.tzinfo else value.replace(tzinfo=timezone.utc)
+    check_rate_limit(request, db, settings)

apps/api/app/media_catalog.py

@@ -0,0 +1,121 @@
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+
+
+MEDIA_ROOT = Path(os.environ.get("MEDIA_ROOT", "data/media")).resolve()
+
+
+def published_assets(entity_type: str | None = None) -> list[dict]:
+    manifest = json.loads((MEDIA_ROOT / "manifest.json").read_text(encoding="utf-8"))
+    result = []
+    for item in manifest.get("assets", []):
+        if item.get("status") != "approved" or not item.get("sha256") or not item.get("local_path"):
+            continue
+        if entity_type and item.get("entity_type") != entity_type:
+            continue
+        source_page = str(item.get("source_page") or "")
+        source = "rf4db" if "rf4db.com" in source_page else "rf4map" if "rf4map.ru" in source_page else "rf4-official"
+        result.append({
+            "id": item["sha256"],
+            "entity_type": item.get("entity_type"),
+            "entity_key": item.get("entity_key"),
+            "label": item.get("label"),
+            "width": item.get("width"),
+            "height": item.get("height"),
+            "content_type": item.get("content_type"),
+            "image_url": f"/api/v1/media/assets/{item['sha256']}",
+            "source_system": source,
+            "source_url": source_page,
+            "variants": [
+                {
+                    "role": variant.get("role"),
+                    "format": variant.get("format"),
+                    "width": variant.get("width"),
+                    "height": variant.get("height"),
+                    "url": f"/api/v1/media/assets/{variant['sha256']}",
+                }
+                for variant in item.get("derivatives", [])
+                if variant.get("sha256") and variant.get("local_path")
+            ],
+        })
+    return sorted(result, key=lambda item: (str(item["entity_type"]), str(item["label"] or "").casefold(), item["id"]))
+
+
+def published_file(digest: str) -> tuple[Path, str] | None:
+    if len(digest) != 64 or any(char not in "0123456789abcdef" for char in digest):
+        return None
+    manifest = json.loads((MEDIA_ROOT / "manifest.json").read_text(encoding="utf-8"))
+    item = next((row for row in manifest.get("assets", []) if row.get("status") == "approved" and row.get("sha256") == digest), None)
+    media_type = None
+    local_path = None
+    if item:
+        media_type = item.get("content_type")
+        local_path = item.get("local_path")
+    else:
+        for row in manifest.get("assets", []):
+            if row.get("status") != "approved":
+                continue
+            variant = next((candidate for candidate in row.get("derivatives", []) if candidate.get("sha256") == digest), None)
+            if variant:
+                media_type = variant.get("content_type")
+                local_path = variant.get("local_path")
+                break
+    if not local_path:
+        return None
+    target = (MEDIA_ROOT / local_path).resolve()
+    if not target.is_relative_to(MEDIA_ROOT.resolve()) or not target.is_file():
+        return None
+    return target, str(media_type or "application/octet-stream")
+
+
+def review_assets(entity_type: str | None = None, status: str | None = None) -> list[dict]:
+    manifest = json.loads((MEDIA_ROOT / "manifest.json").read_text(encoding="utf-8"))
+    result = []
+    for item in manifest.get("assets", []):
+        item_status = str(item.get("status") or "")
+        if item_status not in {"approved", "upgrade_queued", "upgrade_stored"} or (status and item_status != status):
+            continue
+        if entity_type and item.get("entity_type") != entity_type:
+            continue
+        digest = str(item.get("sha256") or "")
+        if len(digest) != 64 or not item.get("local_path"):
+            continue
+        source_page = str(item.get("source_page") or "")
+        source = "rf4db" if "rf4db.com" in source_page else "rf4map" if "rf4map.ru" in source_page else "rf4-official"
+        result.append({
+            "id": digest,
+            "status": item_status,
+            "entity_type": item.get("entity_type"),
+            "entity_key": item.get("entity_key"),
+            "label": item.get("label"),
+            "width": item.get("width"),
+            "height": item.get("height"),
+            "content_type": item.get("content_type"),
+            "image_url": f"/api/v1/admin/media/assets/{digest}",
+            "asset_url": item.get("asset_url", ""),
+            "source_system": source,
+            "source_url": source_page,
+            "duplicate_of": item.get("duplicate_of"),
+            "supersedes": item.get("supersedes"),
+            "derivatives": [{
+                "role": variant.get("role"), "format": variant.get("format"),
+                "width": variant.get("width"), "height": variant.get("height"),
+            } for variant in item.get("derivatives", [])],
+        })
+    return sorted(result, key=lambda item: (str(item["status"]), str(item["entity_type"]), str(item["label"] or "").casefold(), item["id"]))
+
+
+def review_file(digest: str) -> tuple[Path, str] | None:
+    if len(digest) != 64 or any(char not in "0123456789abcdef" for char in digest):
+        return None
+    manifest = json.loads((MEDIA_ROOT / "manifest.json").read_text(encoding="utf-8"))
+    item = next((row for row in manifest.get("assets", []) if row.get("sha256") == digest and row.get("status") in {"approved", "upgrade_queued", "upgrade_stored"}), None)
+    if not item or not item.get("local_path"):
+        return None
+    target = (MEDIA_ROOT / item["local_path"]).resolve()
+    if not target.is_relative_to(MEDIA_ROOT.resolve()) or not target.is_file():
+        return None
+    return target, str(item.get("content_type") or "application/octet-stream")

apps/api/app/models.py

@@ -49,6 +49,16 @@ class Waterbody(Base):
     slug: Mapped[str] = mapped_column(String(100), unique=True)
     name_ru: Mapped[str] = mapped_column(String(200), unique=True)
     unlock_level: Mapped[int | None]
+    fish_species_count: Mapped[int | None]
+    source_system: Mapped[str | None] = mapped_column(String(50))
+    source_external_id: Mapped[str | None] = mapped_column(String(200))
+    source_url: Mapped[str | None] = mapped_column(Text)
+    description: Mapped[str | None] = mapped_column(Text)
+    source_aliases: Mapped[list[str] | None] = mapped_column(JSON)
+    source_fish_species: Mapped[list[str] | None] = mapped_column(JSON)
+    source_image_urls: Mapped[list[str] | None] = mapped_column(JSON)
+    source_point_urls: Mapped[list[str] | None] = mapped_column(JSON)
+    source_checked_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
 
 
 class Bait(Base):
@@ -59,6 +69,61 @@ class Bait(Base):
     kind: Mapped[BaitKind] = mapped_column(Enum(BaitKind))
 
 
+class TackleItem(Base):
+    """Canonical gear item; legacy Bait rows remain source-compatible."""
+
+    __tablename__ = "tackle_item"
+    __table_args__ = (
+        UniqueConstraint("source_system", "source_external_id"),
+        CheckConstraint(
+            "category IN ('bait', 'lure', 'rod', 'reel', 'line', 'hook', 'rig', 'float', 'sinker', 'other')",
+            name="ck_tackle_item_category",
+        ),
+    )
+    id: Mapped[uuid.UUID] = mapped_column(primary_key=True, default=uuid.uuid4)
+    name: Mapped[str] = mapped_column(String(200))
+    normalized_name: Mapped[str] = mapped_column(String(200), unique=True)
+    category: Mapped[str] = mapped_column(String(20))
+    subcategory: Mapped[str | None] = mapped_column(String(100))
+    brand: Mapped[str | None] = mapped_column(String(100))
+    family: Mapped[str | None] = mapped_column(String(100))
+    unlock_level: Mapped[int | None]
+    source_system: Mapped[str | None] = mapped_column(String(50))
+    source_external_id: Mapped[str | None] = mapped_column(String(200))
+    source_url: Mapped[str | None] = mapped_column(Text)
+    source_checked_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+    raw_payload: Mapped[dict | None] = mapped_column(JSON)
+    rig_components: Mapped[list["RigComponent"]] = relationship(back_populates="tackle_item")
+
+
+class Rig(Base):
+    """A named rig/setup kept separate from individual tackle items."""
+
+    __tablename__ = "rig"
+    id: Mapped[uuid.UUID] = mapped_column(primary_key=True, default=uuid.uuid4)
+    name: Mapped[str] = mapped_column(String(200))
+    normalized_name: Mapped[str] = mapped_column(String(200), unique=True)
+    source_system: Mapped[str | None] = mapped_column(String(50))
+    source_external_id: Mapped[str | None] = mapped_column(String(200))
+    source_url: Mapped[str | None] = mapped_column(Text)
+    source_checked_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+    raw_payload: Mapped[dict | None] = mapped_column(JSON)
+    components: Mapped[list["RigComponent"]] = relationship(back_populates="rig")
+
+
+class RigComponent(Base):
+    __tablename__ = "rig_component"
+    __table_args__ = (UniqueConstraint("rig_id", "position"),)
+    id: Mapped[uuid.UUID] = mapped_column(primary_key=True, default=uuid.uuid4)
+    rig_id: Mapped[uuid.UUID] = mapped_column(ForeignKey("rig.id"))
+    tackle_item_id: Mapped[uuid.UUID | None] = mapped_column(ForeignKey("tackle_item.id"))
+    role: Mapped[str] = mapped_column(String(50))
+    position: Mapped[int] = mapped_column(Integer)
+    raw_value: Mapped[str | None] = mapped_column(String(200))
+    rig: Mapped[Rig] = relationship(back_populates="components")
+    tackle_item: Mapped[TackleItem | None] = relationship(back_populates="rig_components")
+
+
 class Spot(Base):
     __tablename__ = "spot"
     __table_args__ = (UniqueConstraint("waterbody_id", "x", "y"),)
@@ -95,10 +160,39 @@ class CatchReport(Base):
     screenshot_upload_token_hash: Mapped[str | None] = mapped_column(String(64))
     deleted_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
     raw_payload: Mapped[dict | None] = mapped_column(JSON)
+    moderation_version: Mapped[int] = mapped_column(default=0)
     fish: Mapped[Fish] = relationship()
     spot: Mapped[Spot | None] = relationship()
     waterbody: Mapped[Waterbody] = relationship()
     bait: Mapped[Bait | None] = relationship()
+    tackle_components: Mapped[list["CatchTackleComponent"]] = relationship(back_populates="catch_report")
+
+
+class CatchTackleComponent(Base):
+    """Ordered gear evidence; unresolved raw values are valid and preserved."""
+
+    __tablename__ = "catch_tackle_component"
+    __table_args__ = (
+        UniqueConstraint("catch_report_id", "position"),
+        CheckConstraint(
+            "NOT (tackle_item_id IS NOT NULL AND rig_id IS NOT NULL)",
+            name="ck_catch_tackle_one_canonical_target",
+        ),
+    )
+    id: Mapped[uuid.UUID] = mapped_column(primary_key=True, default=uuid.uuid4)
+    catch_report_id: Mapped[uuid.UUID] = mapped_column(ForeignKey("catch_report.id"))
+    tackle_item_id: Mapped[uuid.UUID | None] = mapped_column(ForeignKey("tackle_item.id"))
+    rig_id: Mapped[uuid.UUID | None] = mapped_column(ForeignKey("rig.id"))
+    role: Mapped[str] = mapped_column(String(50))
+    position: Mapped[int] = mapped_column(Integer)
+    raw_value: Mapped[str] = mapped_column(String(200))
+    source_system: Mapped[str | None] = mapped_column(String(50))
+    source_external_id: Mapped[str | None] = mapped_column(String(200))
+    source_url: Mapped[str | None] = mapped_column(Text)
+    raw_payload: Mapped[dict | None] = mapped_column(JSON)
+    catch_report: Mapped[CatchReport] = relationship(back_populates="tackle_components")
+    tackle_item: Mapped[TackleItem | None] = relationship()
+    rig: Mapped[Rig | None] = relationship()
 
 
 class OfficialRecordImport(Base):
@@ -143,6 +237,13 @@ class SubmissionAttempt(Base):
     catch_report: Mapped[CatchReport | None] = relationship()
 
 
+class AdminAuthAttempt(Base):
+    __tablename__ = "admin_auth_attempt"
+    id: Mapped[uuid.UUID] = mapped_column(primary_key=True, default=uuid.uuid4)
+    client_hash: Mapped[str] = mapped_column(String(64), index=True)
+    created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), index=True)
+
+
 class DataSource(Base):
     __tablename__ = "data_source"
     key: Mapped[str] = mapped_column(String(50), primary_key=True)
@@ -179,6 +280,8 @@ class ExternalObservation(Base):
     waterbody_external_id: Mapped[str | None] = mapped_column(String(200))
     x: Mapped[int | None]
     y: Mapped[int | None]
+    coordinate_raw: Mapped[str | None] = mapped_column(String(200))
+    coordinate_precision: Mapped[str] = mapped_column(String(20), default="missing")
     weight_g: Mapped[int | None]
     published_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
     first_seen_at: Mapped[datetime] = mapped_column(DateTime(timezone=True))
@@ -190,6 +293,9 @@ class ExternalObservation(Base):
     catch_report_id: Mapped[uuid.UUID | None] = mapped_column(ForeignKey("catch_report.id"), unique=True)
     review_note: Mapped[str | None] = mapped_column(Text)
     reviewed_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+    moderation_version: Mapped[int] = mapped_column(default=0)
+    source_check_status: Mapped[str | None] = mapped_column(String(30))
+    source_checked_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
     source: Mapped[DataSource] = relationship()
     fish: Mapped[Fish | None] = relationship()
     waterbody: Mapped[Waterbody | None] = relationship()

apps/api/app/routers/__init__.py

@@ -0,0 +1 @@
+"""HTTP route groups for the RF4 Spotter API."""

apps/api/app/routers/activity.py

@@ -0,0 +1,113 @@
+from collections import Counter
+from datetime import datetime, timedelta, timezone
+from typing import Literal
+from uuid import UUID
+
+from fastapi import APIRouter, HTTPException, Query, Response
+from sqlalchemy import func, select
+from sqlalchemy.orm import Session, joinedload, selectinload
+
+from ..activity import activity_rows
+from ..config import settings
+from ..dependencies import Db
+from ..models import CatchReport, ModerationStatus, SourceType, Spot, Waterbody
+from ..public_cache import public_cache
+from ..schemas import CatchOut, PaginatedActivityOut, SpotOut
+from ..time_utils import aware
+
+router = APIRouter()
+
+
+@router.get("/api/v1/activity", response_model=PaginatedActivityOut)
+def activity(db: Db, response: Response, hours: int = Query(24), waterbody: str | None = None,
+             fish: str | None = None, method: str | None = None,
+             sort: Literal["activity", "confidence", "freshness"] = "activity",
+             limit: int = Query(20, ge=1, le=100), offset: int = Query(0, ge=0)) -> PaginatedActivityOut:
+    if hours not in {6, 12, 24, 72}:
+        raise HTTPException(status_code=422, detail="hours must be one of: 6, 12, 24, 72")
+    response.headers["Cache-Control"] = "no-store"
+    generation = public_cache.generation()
+    cache_key = ("activity", hours, waterbody, fish, method, sort, limit, offset)
+    cached = public_cache.get(cache_key, settings.public_cache_seconds)
+    if cached is not None:
+        response.headers["X-Cache"] = "HIT"
+        return cached
+    rows = activity_rows(db, hours=hours, waterbody=waterbody, fish=fish, method=method)
+    total = len(rows)
+    keys = {
+        "activity": lambda row: (row.activity_score, row.confidence_score, row.last_confirmed_at, str(row.spot_id)),
+        "confidence": lambda row: (row.confidence_score, row.activity_score, row.last_confirmed_at, str(row.spot_id)),
+        "freshness": lambda row: (row.last_confirmed_at, row.activity_score, row.confidence_score, str(row.spot_id)),
+    }
+    rows.sort(key=keys[sort], reverse=True)
+    response.headers["X-Cache"] = "MISS"
+    return public_cache.set(cache_key, PaginatedActivityOut(items=rows[offset:offset + limit], total=total, limit=limit, offset=offset), generation=generation)
+
+
+def _spot_or_404(db: Session, spot_id: UUID) -> Spot:
+    spot = db.scalar(select(Spot).options(joinedload(Spot.waterbody)).where(Spot.id == spot_id))
+    if spot is None:
+        raise HTTPException(status_code=404, detail="spot not found")
+    return spot
+
+
+@router.get("/api/v1/spots/resolve", response_model=SpotOut)
+def resolve_spot(db: Db, waterbody: str, x: int = Query(ge=-10_000, le=10_000), y: int = Query(ge=-10_000, le=10_000)) -> SpotOut:
+    spot = db.scalar(select(Spot).options(joinedload(Spot.waterbody)).join(Spot.waterbody).where(Waterbody.slug == waterbody, Spot.x == x, Spot.y == y))
+    if spot is None:
+        raise HTTPException(status_code=404, detail="spot not found")
+    return spot_detail(spot.id, db)
+
+
+@router.get("/api/v1/spots/{spot_id}", response_model=SpotOut)
+def spot_detail(spot_id: UUID, db: Db) -> SpotOut:
+    spot = _spot_or_404(db, spot_id)
+    reports = list(db.scalars(select(CatchReport).options(joinedload(CatchReport.bait)).where(CatchReport.spot_id == spot.id, CatchReport.moderation_status == ModerationStatus.approved, CatchReport.deleted_at.is_(None))))
+    now = datetime.now(timezone.utc)
+    bait_counts = Counter(report.bait.name for report in reports if report.bait)
+    def count_since(delta: timedelta) -> int:
+        return sum(aware(report.reported_at) >= now - delta for report in reports)
+
+    provenance = [
+        (report.raw_payload or {}).get("provenance", {})
+        for report in reports
+        if isinstance((report.raw_payload or {}).get("provenance", {}), dict)
+    ]
+    precisions = [item.get("coordinate_precision") for item in provenance]
+    precision = max((value for value in precisions if value in {"exact", "approximate", "area", "missing"}), key={"exact": 0, "approximate": 1, "area": 2, "missing": 3}.get, default="exact")
+    sources = sorted({str(item.get("source_system")) for item in provenance if item.get("source_system")}) or ["players"]
+    return SpotOut(id=spot.id, waterbody_slug=spot.waterbody.slug, waterbody=spot.waterbody.name_ru, x=spot.x, y=spot.y, description=spot.description, catches_24h=count_since(timedelta(hours=24)), catches_3d=count_since(timedelta(days=3)), catches_7d=count_since(timedelta(days=7)), top_baits=[name for name, _ in bait_counts.most_common(5)], coordinate_precision=precision, coordinate_sources=sources)
+
+
+def _report_source(report: CatchReport) -> str:
+    provenance = (report.raw_payload or {}).get("provenance", {})
+    if isinstance(provenance, dict) and provenance.get("source_system"):
+        return str(provenance["source_system"])
+    if report.source_type == SourceType.official_record:
+        return "rf4-official"
+    return "players" if report.source_type == SourceType.user else "manual-import"
+
+
+@router.get("/api/v1/spots/{spot_id}/catches", response_model=list[CatchOut])
+def spot_catches(spot_id: UUID, db: Db, limit: int = Query(50, ge=1, le=100), offset: int = Query(0, ge=0)) -> list[CatchOut]:
+    _spot_or_404(db, spot_id)
+    reports = list(db.scalars(select(CatchReport).options(joinedload(CatchReport.fish), joinedload(CatchReport.bait), selectinload(CatchReport.tackle_components)).where(CatchReport.spot_id == spot_id, CatchReport.moderation_status == ModerationStatus.approved, CatchReport.deleted_at.is_(None)).order_by(CatchReport.reported_at.desc(), CatchReport.id.desc()).offset(offset).limit(limit)))
+    return [CatchOut(id=report.id, fish=report.fish.name_ru, weight_g=report.weight_g, bait=report.bait.name if report.bait else None, player_name=report.player_name, caught_at=report.caught_at, reported_at=report.reported_at, retrieve_method=report.retrieve_method, retrieve_speed=report.retrieve_speed, source_system=_report_source(report), source_url=report.source_url, tackle_components=[{
+        "id": component.id, "role": component.role, "position": component.position,
+        "raw_value": component.raw_value, "tackle_item_id": component.tackle_item_id,
+        "rig_id": component.rig_id, "source_system": component.source_system,
+        "source_url": component.source_url,
+    } for component in sorted(report.tackle_components, key=lambda value: value.position)]) for report in reports]
+
+
+@router.get("/api/v1/spots/{spot_id}/timeline")
+def spot_timeline(spot_id: UUID, db: Db) -> list[dict]:
+    _spot_or_404(db, spot_id)
+    now = datetime.now(timezone.utc)
+    buckets = []
+    for index in range(6):
+        start = now - timedelta(hours=(6 - index) * 12)
+        end = start + timedelta(hours=12)
+        count = db.scalar(select(func.count()).select_from(CatchReport).where(CatchReport.spot_id == spot_id, CatchReport.moderation_status == ModerationStatus.approved, CatchReport.deleted_at.is_(None), CatchReport.reported_at >= start, CatchReport.reported_at < end)) or 0
+        buckets.append({"start": start.isoformat(), "end": end.isoformat(), "count": count})
+    return buckets

apps/api/app/routers/admin.py

@@ -0,0 +1,426 @@
+from __future__ import annotations
+
+from datetime import datetime, timedelta, timezone
+from typing import Annotated, Literal
+from uuid import UUID
+
+import httpx
+from fastapi import APIRouter, Depends, Header, HTTPException, Query, Request, Response
+from fastapi.responses import FileResponse, JSONResponse
+from sqlalchemy import case, func, or_, select
+from sqlalchemy.orm import joinedload
+
+from ..admin_security import verify_admin
+from ..community_review import ExternalReviewError, map_observation, publish_observation, reject_observation, suggest_aliases
+from ..config import settings
+from ..dependencies import Db
+from ..importer import ImportAlreadyRunning, ImportSourceError, import_records
+from rf4_research.media_assets import publish_quality_upgrades, rollback_quality_upgrade
+
+from ..media_catalog import MEDIA_ROOT, review_assets, review_file
+from ..models import CatchReport, CommunityImportRun, DataSource, ExternalObservation, Fish, ModerationEvent, ModerationStatus, OfficialRecordImport, SourceType, Waterbody
+from ..public_cache import public_cache
+from ..schemas import AdminCatchReportOut, AdminMediaDecision, AdminMediaReviewOut, AdminMediaRollback, AdminModerationHistoryOut, AdminSourceStatusOut, CatchReportCreated, ExternalAliasSuggestionOut, ExternalObservationAction, ExternalObservationDecision, ExternalObservationMapping, ExternalObservationOut, ExternalObservationPublished, ImportRunOut, ModerationUpdate
+from ..storage import delete_screenshot, signed_screenshot_url
+from ..time_utils import aware
+
+
+router = APIRouter()
+
+
+def _admin(request: Request, db: Db, authorization: Annotated[str | None, Header()] = None) -> str:
+    return verify_admin(request, db, authorization, settings)
+
+
+@router.get("/api/v1/admin/media/catalog", response_model=list[AdminMediaReviewOut])
+def admin_media_catalog(
+    _: Annotated[str, Depends(_admin)],
+    entity_type: str | None = Query(None, pattern="^(fish|waterbody|tackle|reference)$"),
+    status: str | None = Query(None, pattern="^(approved|upgrade_queued|upgrade_stored)$"),
+    limit: int = Query(50, ge=1, le=100),
+    offset: int = Query(0, ge=0),
+) -> list[AdminMediaReviewOut]:
+    return review_assets(entity_type, status)[offset:offset + limit]
+
+
+@router.get("/api/v1/admin/media/assets/{digest}", response_class=FileResponse)
+def admin_media_asset(digest: str, _: Annotated[str, Depends(_admin)]) -> FileResponse:
+    item = review_file(digest)
+    if not item:
+        raise HTTPException(status_code=404, detail="Media review asset not found")
+    path, media_type = item
+    return FileResponse(path, media_type=media_type, headers={"Cache-Control": "private, no-store"})
+
+
+@router.post("/api/v1/admin/media/upgrades/publish")
+def admin_publish_media_upgrades(
+    payload: AdminMediaDecision,
+    _: Annotated[str, Depends(_admin)],
+) -> dict[str, int]:
+    """Atomically publish all stored quality upgrades after an explicit decision."""
+    try:
+        return publish_quality_upgrades(MEDIA_ROOT / "manifest.json", note=payload.note)
+    except ValueError as exc:
+        raise HTTPException(status_code=409, detail=str(exc)) from exc
+
+
+@router.post("/api/v1/admin/media/upgrades/rollback")
+def admin_rollback_media_upgrade(
+    payload: AdminMediaRollback,
+    _: Annotated[str, Depends(_admin)],
+) -> dict[str, str]:
+    """Restore one superseded fallback while retaining the reviewed candidate."""
+    try:
+        return rollback_quality_upgrade(
+            MEDIA_ROOT / "manifest.json", asset_url=payload.asset_url, note=payload.note,
+        )
+    except ValueError as exc:
+        raise HTTPException(status_code=409, detail=str(exc)) from exc
+
+
+@router.get("/api/v1/admin/diagnostics")
+def admin_diagnostics(db: Db, _: Annotated[str, Depends(_admin)]) -> JSONResponse:
+    report_counts = {status.value: count for status, count in db.execute(
+        select(CatchReport.moderation_status, func.count()).group_by(CatchReport.moderation_status)
+    )}
+    observation_counts = {status: count for status, count in db.execute(
+        select(ExternalObservation.status, func.count()).group_by(ExternalObservation.status)
+    )}
+    payload = {
+        "generated_at": datetime.now(timezone.utc).isoformat(),
+        "build": {"version": settings.app_version, "revision": settings.app_revision, "environment": settings.deployment_environment},
+        "counts": {
+            "catch_reports": report_counts,
+            "external_observations": observation_counts,
+            "data_sources": db.scalar(select(func.count()).select_from(DataSource)) or 0,
+            "enabled_data_sources": db.scalar(select(func.count()).select_from(DataSource).where(DataSource.enabled.is_(True))) or 0,
+            "official_import_runs": db.scalar(select(func.count()).select_from(OfficialRecordImport)) or 0,
+            "community_import_runs": db.scalar(select(func.count()).select_from(CommunityImportRun)) or 0,
+        },
+    }
+    return JSONResponse(payload, headers={"Content-Disposition": "attachment; filename=rf4spotter-diagnostics.json"})
+
+
+@router.get("/api/v1/admin/moderation-history", response_model=list[AdminModerationHistoryOut])
+def admin_moderation_history(
+    db: Db,
+    _: Annotated[str, Depends(_admin)],
+    limit: int = Query(50, ge=1, le=200),
+    offset: int = Query(0, ge=0),
+) -> list[AdminModerationHistoryOut]:
+    report_events = list(db.scalars(
+        select(ModerationEvent).order_by(ModerationEvent.created_at.desc()).limit(limit + offset)
+    ))
+    external_events = list(db.scalars(
+        select(ExternalObservation).where(ExternalObservation.reviewed_at.is_not(None))
+        .order_by(ExternalObservation.reviewed_at.desc()).limit(limit + offset)
+    ))
+    history = [AdminModerationHistoryOut(
+        entity_type="catch_report", entity_id=event.catch_report_id,
+        decided_at=event.created_at, action=event.new_status.value,
+        moderator=event.moderator, reason=event.reason,
+    ) for event in report_events]
+    history.extend(AdminModerationHistoryOut(
+        entity_type="external_observation", entity_id=observation.id,
+        decided_at=observation.reviewed_at, action=observation.status,
+        moderator=None, reason=observation.review_note,
+    ) for observation in external_events if observation.reviewed_at is not None)
+    history.sort(key=lambda event: aware(event.decided_at), reverse=True)
+    return history[offset:offset + limit]
+
+
+@router.get("/api/v1/admin/moderation-history-export")
+def admin_moderation_history_export(
+    db: Db,
+    _: Annotated[str, Depends(_admin)],
+    limit: int = Query(1000, ge=1, le=5000),
+) -> JSONResponse:
+    """Return an anonymized, analysis-safe decision export."""
+    events = admin_moderation_history(db, _, limit=limit, offset=0)
+    payload = {
+        "generated_at": datetime.now(timezone.utc).isoformat(),
+        "count": len(events),
+        "events": [{
+            "entity_type": event.entity_type,
+            "decided_at": event.decided_at.isoformat(),
+            "action": event.action,
+            "requires_confirmation": event.requires_confirmation,
+        } for event in events],
+    }
+    return JSONResponse(payload, headers={
+        "Content-Disposition": "attachment; filename=rf4spotter-moderation-history.json",
+    })
+
+
+@router.get("/api/v1/admin/imports", response_model=list[ImportRunOut])
+def admin_imports(
+    db: Db,
+    _: Annotated[str, Depends(_admin)],
+    limit: int = Query(20, ge=1, le=100),
+    offset: int = Query(0, ge=0),
+) -> list[OfficialRecordImport]:
+    query = select(OfficialRecordImport).order_by(
+        OfficialRecordImport.started_at.desc(), OfficialRecordImport.id.desc()
+    ).offset(offset).limit(limit)
+    return list(db.scalars(query))
+
+
+@router.post("/api/v1/admin/imports/official-records", response_model=ImportRunOut, status_code=201)
+def admin_start_official_import(db: Db, _: Annotated[str, Depends(_admin)]) -> OfficialRecordImport:
+    try:
+        return import_records(
+            db,
+            url=settings.official_records_url,
+            region=settings.official_records_region,
+            category=settings.official_records_category,
+        )
+    except ImportAlreadyRunning as exc:
+        raise HTTPException(status_code=409, detail=str(exc)) from exc
+    except (ImportSourceError, httpx.HTTPError) as exc:
+        raise HTTPException(status_code=502, detail=f"official records import failed: {exc}") from exc
+
+
+@router.get("/api/v1/admin/source-status", response_model=list[AdminSourceStatusOut])
+def admin_source_status(db: Db, _: Annotated[str, Depends(_admin)]) -> list[AdminSourceStatusOut]:
+    """Return safe operational details needed by the owner dashboard."""
+    now = datetime.now(timezone.utc)
+    result: list[AdminSourceStatusOut] = []
+    for source in db.scalars(select(DataSource).order_by(DataSource.name)):
+        runs = list(db.scalars(
+            select(CommunityImportRun)
+            .where(CommunityImportRun.source_system == source.key)
+            .order_by(CommunityImportRun.started_at.desc()).limit(20)
+        ))
+        latest = runs[0] if runs else None
+        success = next((run for run in runs if run.status == "success"), None)
+        recent_failures = sum(
+            1 for run in runs
+            if run.status == "failed" and aware(run.started_at) >= now - timedelta(hours=24)
+        )
+        next_allowed = (
+            aware(latest.started_at) + timedelta(seconds=settings.community_import_interval_seconds)
+            if latest else None
+        )
+        cooldown_seconds = max(0, int((next_allowed - now).total_seconds())) if next_allowed else 0
+        if not source.enabled:
+            state = "disabled"
+        elif latest is None:
+            state = "waiting"
+        elif latest.status == "failed":
+            state = "source_changed" if "CommunityParseError" in (latest.error_summary or "") else "temporarily_limited"
+        elif aware(latest.started_at) < now - timedelta(seconds=settings.community_import_interval_seconds * 2):
+            state = "stale"
+        else:
+            state = "healthy"
+        result.append(AdminSourceStatusOut(
+            source_system=source.key,
+            name=source.name,
+            status=state,
+            last_started_at=latest.started_at if latest else None,
+            last_success_at=success.started_at if success else None,
+            next_allowed_at=next_allowed,
+            cooldown_seconds=cooldown_seconds,
+            recent_failures_24h=recent_failures,
+            backoff_recommended=recent_failures >= 5,
+        ))
+    return result
+
+
+def _external_out(item: ExternalObservation) -> ExternalObservationOut:
+    allowed_payload = {
+        key: value for key, value in (item.payload or {}).items()
+        if key in {
+            "bait", "fishing_method", "rig_type", "retrieve_method", "retrieve_speed",
+            "player_name", "published_at", "region", "category",
+        } and (value is None or isinstance(value, (str, int, float, bool)))
+    }
+    missing_fields = []
+    if item.x is None or item.y is None:
+        missing_fields.append("coordinates")
+    if item.weight_g is None:
+        missing_fields.append("weight_g")
+    return ExternalObservationOut(
+        id=item.id, source_system=item.source_system, source_external_id=item.source_external_id,
+        source_url=item.source_url, fish_name=item.fish_name, fish_external_id=item.fish_external_id,
+        waterbody_name=item.waterbody_name, waterbody_external_id=item.waterbody_external_id,
+        x=item.x, y=item.y, weight_g=item.weight_g, published_at=item.published_at,
+        first_seen_at=item.first_seen_at, last_seen_at=item.last_seen_at, reviewed_at=item.reviewed_at,
+        status=item.status,
+        fish_slug=item.fish.slug if item.fish else None,
+        waterbody_slug=item.waterbody.slug if item.waterbody else None,
+        catch_report_id=item.catch_report_id, review_note=item.review_note,
+        missing_fields=missing_fields, source_payload=allowed_payload,
+        moderation_version=item.moderation_version,
+        source_check_status=item.source_check_status, source_checked_at=item.source_checked_at,
+    )
+
+
+@router.get("/api/v1/admin/external-observations", response_model=list[ExternalObservationOut])
+def admin_external_observations(
+    db: Db, _: Annotated[str, Depends(_admin)],
+    status: Literal["staged", "mapped", "ready", "published", "rejected", "withdrawn", "review"] | None = None,
+    source_system: str | None = None,
+    completeness: Literal["all", "complete", "incomplete"] = "all",
+    order: Literal["newest", "oldest", "risk"] = "newest",
+    q: str | None = Query(None, max_length=100),
+    limit: int = Query(50, ge=1, le=200), offset: int = Query(0, ge=0),
+) -> list[ExternalObservationOut]:
+    query = select(ExternalObservation).options(
+        joinedload(ExternalObservation.fish), joinedload(ExternalObservation.waterbody),
+    )
+    if status == "review":
+        query = query.where(ExternalObservation.status.in_(["staged", "mapped", "ready"]))
+    elif status:
+        query = query.where(ExternalObservation.status == status)
+    if source_system:
+        query = query.where(ExternalObservation.source_system == source_system)
+    if completeness == "complete":
+        query = query.where(
+            ExternalObservation.x.is_not(None), ExternalObservation.y.is_not(None),
+            ExternalObservation.weight_g.is_not(None),
+        )
+    elif completeness == "incomplete":
+        query = query.where(or_(
+            ExternalObservation.x.is_(None), ExternalObservation.y.is_(None),
+            ExternalObservation.weight_g.is_(None),
+        ))
+    if q and q.strip():
+        term = q.strip()
+        query = query.where(or_(
+            ExternalObservation.fish_name.icontains(term, autoescape=True),
+            ExternalObservation.waterbody_name.icontains(term, autoescape=True),
+        ))
+    if order == "risk":
+        incomplete = case(
+            (or_(ExternalObservation.x.is_(None), ExternalObservation.y.is_(None), ExternalObservation.weight_g.is_(None)), 0),
+            else_=1,
+        )
+        workflow = case(
+            (ExternalObservation.status == "staged", 0),
+            (ExternalObservation.status == "mapped", 1),
+            else_=2,
+        )
+        ordering = (incomplete, workflow, ExternalObservation.last_seen_at.asc(), ExternalObservation.id.desc())
+    else:
+        direction = ExternalObservation.last_seen_at.asc() if order == "oldest" else ExternalObservation.last_seen_at.desc()
+        ordering = (direction, ExternalObservation.id.desc())
+    items = db.scalars(query.order_by(*ordering).offset(offset).limit(limit))
+    return [_external_out(item) for item in items]
+
+
+@router.get("/api/v1/admin/external-observations/{observation_id}/alias-suggestions", response_model=ExternalAliasSuggestionOut)
+def admin_external_alias_suggestions(
+    observation_id: UUID, db: Db, _: Annotated[str, Depends(_admin)],
+) -> ExternalAliasSuggestionOut:
+    observation = db.get(ExternalObservation, observation_id)
+    if observation is None:
+        raise HTTPException(status_code=404, detail="external observation not found")
+    fish, waterbody = suggest_aliases(db, observation)
+    return ExternalAliasSuggestionOut(
+        fish_slug=fish.slug if fish else None,
+        waterbody_slug=waterbody.slug if waterbody else None,
+    )
+
+
+@router.patch("/api/v1/admin/external-observations/{observation_id}/mapping", response_model=ExternalObservationOut)
+def admin_map_external_observation(
+    observation_id: UUID, payload: ExternalObservationMapping, db: Db,
+    _: Annotated[str, Depends(_admin)],
+) -> ExternalObservationOut:
+    observation = db.scalar(select(ExternalObservation).where(ExternalObservation.id == observation_id).with_for_update())
+    fish = db.scalar(select(Fish).where(Fish.slug == payload.fish_slug))
+    waterbody = db.scalar(select(Waterbody).where(Waterbody.slug == payload.waterbody_slug))
+    if observation is None:
+        raise HTTPException(status_code=404, detail="external observation not found")
+    if fish is None or waterbody is None:
+        raise HTTPException(status_code=422, detail="unknown fish or waterbody")
+    if observation.moderation_version != payload.expected_version:
+        raise HTTPException(status_code=409, detail="observation changed; reload the queue")
+    observation.moderation_version += 1
+    try:
+        return _external_out(map_observation(db, observation, fish, waterbody, note=payload.note))
+    except ExternalReviewError as exc:
+        raise HTTPException(status_code=409, detail=str(exc)) from exc
+
+
+@router.post("/api/v1/admin/external-observations/{observation_id}/publish", response_model=ExternalObservationPublished)
+def admin_publish_external_observation(
+    observation_id: UUID, payload: ExternalObservationAction, db: Db, _: Annotated[str, Depends(_admin)],
+) -> ExternalObservationPublished:
+    observation = db.scalar(select(ExternalObservation).where(ExternalObservation.id == observation_id).with_for_update())
+    if observation is None:
+        raise HTTPException(status_code=404, detail="external observation not found")
+    if observation.moderation_version != payload.expected_version:
+        raise HTTPException(status_code=409, detail="observation changed; reload the queue")
+    observation.moderation_version += 1
+    try:
+        report = publish_observation(db, observation)
+    except ExternalReviewError as exc:
+        raise HTTPException(status_code=409, detail=str(exc)) from exc
+    public_cache.invalidate()
+    return ExternalObservationPublished(observation_id=observation.id, catch_report_id=report.id, status=observation.status)
+
+
+@router.patch("/api/v1/admin/external-observations/{observation_id}/reject", response_model=ExternalObservationOut)
+def admin_reject_external_observation(
+    observation_id: UUID, payload: ExternalObservationDecision, db: Db,
+    _: Annotated[str, Depends(_admin)],
+) -> ExternalObservationOut:
+    observation = db.scalar(select(ExternalObservation).where(ExternalObservation.id == observation_id).with_for_update())
+    if observation is None:
+        raise HTTPException(status_code=404, detail="external observation not found")
+    if observation.moderation_version != payload.expected_version:
+        raise HTTPException(status_code=409, detail="observation changed; reload the queue")
+    observation.moderation_version += 1
+    try:
+        return _external_out(reject_observation(db, observation, reason=payload.reason))
+    except ExternalReviewError as exc:
+        raise HTTPException(status_code=409, detail=str(exc)) from exc
+
+
+@router.get("/api/v1/admin/catch-reports", response_model=list[AdminCatchReportOut])
+def admin_reports(db: Db, _: Annotated[str, Depends(_admin)], status: ModerationStatus = ModerationStatus.pending, limit: int = Query(50, ge=1, le=100), offset: int = Query(0, ge=0)) -> list[AdminCatchReportOut]:
+    reports = list(db.scalars(select(CatchReport).options(joinedload(CatchReport.fish), joinedload(CatchReport.waterbody), joinedload(CatchReport.spot), joinedload(CatchReport.bait)).where(CatchReport.source_type == SourceType.user, CatchReport.moderation_status == status, CatchReport.deleted_at.is_(None)).order_by(CatchReport.reported_at, CatchReport.id).offset(offset).limit(limit)))
+    return [AdminCatchReportOut(id=r.id, fish=r.fish.name_ru, waterbody=r.waterbody.name_ru, coordinates=f"{r.spot.x}:{r.spot.y}" if r.spot else "—", weight_g=r.weight_g, bait=r.bait.name if r.bait else None, player_name=r.player_name, reported_at=r.reported_at, moderation_status=r.moderation_status.value, comment=(r.raw_payload or {}).get("comment"), screenshot_url=signed_screenshot_url(r.screenshot_key) if r.screenshot_key else None, moderation_version=r.moderation_version) for r in reports]
+
+
+@router.patch("/api/v1/admin/catch-reports/{report_id}", response_model=CatchReportCreated)
+def moderate_report(report_id: UUID, payload: ModerationUpdate, db: Db, moderator: Annotated[str, Depends(_admin)]) -> CatchReportCreated:
+    report = db.scalar(select(CatchReport).where(CatchReport.id == report_id).with_for_update())
+    if report is None or report.source_type != SourceType.user or report.deleted_at is not None:
+        raise HTTPException(status_code=404, detail="catch report not found")
+    if report.moderation_version != payload.expected_version:
+        raise HTTPException(status_code=409, detail="report changed; reload the queue")
+    previous = report.moderation_status
+    report.moderation_status = ModerationStatus(payload.status)
+    report.moderation_version += 1
+    db.add(ModerationEvent(catch_report=report, created_at=datetime.now(timezone.utc), previous_status=previous, new_status=report.moderation_status, moderator=moderator, reason=payload.reason))
+    db.commit()
+    public_cache.invalidate()
+    return CatchReportCreated(id=report.id, moderation_status=report.moderation_status.value)
+
+
+@router.delete("/api/v1/admin/catch-reports/{report_id}", status_code=204, response_class=Response)
+def delete_report(report_id: UUID, db: Db, moderator: Annotated[str, Depends(_admin)], expected_version: int = Query(ge=0)) -> Response:
+    report = db.scalar(select(CatchReport).where(CatchReport.id == report_id).with_for_update())
+    if report is None or report.source_type != SourceType.user or report.deleted_at is not None:
+        raise HTTPException(status_code=404, detail="catch report not found")
+    if report.moderation_version != expected_version:
+        raise HTTPException(status_code=409, detail="report changed; reload the queue")
+    previous = report.moderation_status
+    if report.screenshot_key:
+        try:
+            delete_screenshot(report.screenshot_key)
+        except Exception as exc:
+            raise HTTPException(status_code=502, detail="screenshot deletion failed") from exc
+    report.moderation_status = ModerationStatus.rejected
+    report.moderation_version += 1
+    report.deleted_at = datetime.now(timezone.utc)
+    report.player_name = None
+    report.source_url = None
+    report.screenshot_key = None
+    report.raw_payload = None
+    db.add(ModerationEvent(catch_report=report, created_at=report.deleted_at, previous_status=previous, new_status=ModerationStatus.rejected, moderator=moderator, reason="user report deleted and anonymized"))
+    db.commit()
+    public_cache.invalidate()
+    return Response(status_code=204)

apps/api/app/routers/analytics.py

@@ -0,0 +1,66 @@
+from __future__ import annotations
+
+from collections import defaultdict
+from datetime import datetime, timedelta, timezone
+
+from fastapi import APIRouter, Query
+from sqlalchemy import select
+from sqlalchemy.orm import Session, joinedload, selectinload
+
+from ..dependencies import Db
+from ..models import CatchReport, Fish, ModerationStatus, Spot, Waterbody
+from ..schemas import TackleCombinationOut
+
+router = APIRouter()
+
+
+@router.get("/api/v1/analytics/tackle", response_model=list[TackleCombinationOut])
+def tackle_combinations(
+    db: Db,
+    waterbody: str | None = None,
+    fish: str | None = None,
+    method: str | None = None,
+    hours: int = Query(72, ge=24, le=168),
+    min_samples: int = Query(3, ge=1, le=100),
+    min_players: int = Query(2, ge=1, le=100),
+) -> list[TackleCombinationOut]:
+    now = datetime.now(timezone.utc)
+    query = select(CatchReport).options(
+        joinedload(CatchReport.fish), joinedload(CatchReport.waterbody),
+        selectinload(CatchReport.tackle_components),
+    ).where(
+        CatchReport.moderation_status == ModerationStatus.approved,
+        CatchReport.deleted_at.is_(None),
+        CatchReport.reported_at >= now - timedelta(hours=hours),
+    )
+    if waterbody:
+        query = query.join(Waterbody, CatchReport.waterbody_id == Waterbody.id).where(Waterbody.slug == waterbody)
+    if fish:
+        query = query.join(Fish, CatchReport.fish_id == Fish.id).where(Fish.slug == fish)
+    if method:
+        query = query.where(CatchReport.fishing_method == method)
+
+    groups: dict[tuple[str, str], list[CatchReport]] = defaultdict(list)
+    for report in db.scalars(query):
+        for component in report.tackle_components:
+            if component.raw_value.strip():
+                groups[(component.role, component.raw_value.strip())].append(report)
+
+    result = []
+    for (role, value), reports in groups.items():
+        unique_reports = {report.id: report for report in reports}
+        players = {report.player_name.strip().casefold() for report in unique_reports.values() if report.player_name and report.player_name.strip()}
+        catches = len(unique_reports)
+        unique_players = len(players)
+        last_seen = max(report.reported_at for report in unique_reports.values())
+        enough = catches >= min_samples and unique_players >= min_players
+        result.append(TackleCombinationOut(
+            role=role, value=value, catches=catches, unique_players=unique_players,
+            last_seen_at=last_seen, status="recommendation" if enough else "insufficient_data",
+            explanation=(
+                "Достаточно независимых наблюдений для рекомендации."
+                if enough else
+                f"Данных мало: нужно минимум {min_samples} наблюдения и {min_players} независимых игрока."
+            ),
+        ))
+    return sorted(result, key=lambda item: (item.status != "recommendation", -item.catches, -item.unique_players, item.role, item.value))

apps/api/app/routers/catalog.py

@@ -0,0 +1,99 @@
+from uuid import UUID
+
+from fastapi import APIRouter, HTTPException, Query
+from sqlalchemy import func, select
+from sqlalchemy.orm import selectinload
+
+from ..dependencies import Db
+from ..models import Bait, CatchReport, Fish, ModerationStatus, Rig, Spot, TackleItem, Waterbody
+from ..schemas import BaitOut, FishOut, PaginatedTackleItemOut, RigOut, TackleItemOut, WaterbodyOut
+
+router = APIRouter()
+
+
+@router.get("/api/v1/fishes", response_model=list[FishOut])
+def fishes(db: Db, limit: int = Query(200, ge=1, le=500), offset: int = Query(0, ge=0)) -> list[Fish]:
+    return list(db.scalars(select(Fish).order_by(Fish.name_ru, Fish.id).offset(offset).limit(limit)))
+
+
+@router.get("/api/v1/waterbodies", response_model=list[WaterbodyOut])
+def waterbodies(db: Db, limit: int = Query(200, ge=1, le=500), offset: int = Query(0, ge=0)) -> list[Waterbody]:
+    return list(db.scalars(select(Waterbody).order_by(Waterbody.name_ru, Waterbody.id).offset(offset).limit(limit)))
+
+
+@router.get("/api/v1/baits", response_model=list[BaitOut])
+def baits(db: Db, limit: int = Query(200, ge=1, le=500), offset: int = Query(0, ge=0)) -> list[Bait]:
+    return list(db.scalars(select(Bait).order_by(Bait.name, Bait.id).offset(offset).limit(limit)))
+
+
+def _item_missing_fields(item: TackleItem) -> list[str]:
+    return [field for field, value in (
+        ("subcategory", item.subcategory), ("brand", item.brand),
+        ("family", item.family), ("unlock_level", item.unlock_level),
+        ("source_url", item.source_url), ("source_checked_at", item.source_checked_at),
+    ) if value is None]
+
+
+@router.get("/api/v1/tackle/items", response_model=PaginatedTackleItemOut)
+def tackle_items(
+    db: Db,
+    category: str | None = Query(None, pattern="^(bait|lure|rod|reel|line|hook|rig|float|sinker|other)$"),
+    brand: str | None = None,
+    family: str | None = None,
+    unlock_level: int | None = Query(None, ge=0),
+    limit: int = Query(50, ge=1, le=100),
+    offset: int = Query(0, ge=0),
+) -> PaginatedTackleItemOut:
+    query = select(TackleItem)
+    if category:
+        query = query.where(TackleItem.category == category)
+    if brand:
+        query = query.where(TackleItem.brand == brand)
+    if family:
+        query = query.where(TackleItem.family == family)
+    if unlock_level is not None:
+        query = query.where(TackleItem.unlock_level == unlock_level)
+    total = db.scalar(query.with_only_columns(func.count(TackleItem.id), maintain_column_froms=True).order_by(None)) or 0
+    items = list(db.scalars(query.order_by(TackleItem.name, TackleItem.id).offset(offset).limit(limit)))
+    return PaginatedTackleItemOut(
+        items=[TackleItemOut.model_validate(item).model_copy(update={"missing_fields": _item_missing_fields(item)}) for item in items],
+        total=total, limit=limit, offset=offset,
+    )
+
+
+@router.get("/api/v1/tackle/items/{item_id}", response_model=TackleItemOut)
+def tackle_item(item_id: UUID, db: Db) -> TackleItemOut:
+    item = db.get(TackleItem, item_id)
+    if item is None:
+        raise HTTPException(status_code=404, detail="tackle item not found")
+    return TackleItemOut.model_validate(item).model_copy(update={"missing_fields": _item_missing_fields(item)})
+
+
+@router.get("/api/v1/tackle/rigs/{rig_id}", response_model=RigOut)
+def rig_detail(rig_id: UUID, db: Db) -> RigOut:
+    rig = db.scalar(select(Rig).options(selectinload(Rig.components)).where(Rig.id == rig_id))
+    if rig is None:
+        raise HTTPException(status_code=404, detail="rig not found")
+    missing = [field for field, value in (
+        ("source_url", rig.source_url), ("source_checked_at", rig.source_checked_at),
+    ) if value is None]
+    return RigOut(
+        id=rig.id, name=rig.name, source_system=rig.source_system,
+        source_external_id=rig.source_external_id, source_url=rig.source_url,
+        source_checked_at=rig.source_checked_at, missing_fields=missing,
+        components=[{
+            "id": component.id, "role": component.role, "position": component.position,
+            "raw_value": component.raw_value, "tackle_item_id": component.tackle_item_id,
+        } for component in sorted(rig.components, key=lambda value: value.position)],
+    )
+
+
+@router.get("/api/v1/public-spot-pages")
+def public_spot_pages(db: Db, limit: int = Query(500, ge=1, le=500), offset: int = Query(0, ge=0)) -> list[str]:
+    rows = db.execute(select(Waterbody.slug, Spot.x, Spot.y, Fish.slug)
+        .select_from(CatchReport).join(Spot, CatchReport.spot_id == Spot.id)
+        .join(Waterbody, Spot.waterbody_id == Waterbody.id).join(Fish, CatchReport.fish_id == Fish.id)
+        .where(CatchReport.moderation_status == ModerationStatus.approved, CatchReport.deleted_at.is_(None))
+        .distinct().order_by(Waterbody.slug, Spot.x, Spot.y, Fish.slug).offset(offset).limit(limit))
+    return [path for water, x, y, fish in rows for path in
+        (f"/spots/{water}-{x}x{y}", f"/waterbodies/{water}/{fish}")]

apps/api/app/routers/media.py

@@ -0,0 +1,24 @@
+from fastapi import APIRouter, HTTPException, Query
+from fastapi.responses import FileResponse
+
+from ..media_catalog import published_assets, published_file
+
+
+router = APIRouter()
+
+
+@router.get("/api/v1/media/catalog")
+def media_catalog(entity_type: str | None = Query(None, pattern="^(fish|waterbody|tackle|reference)$")) -> list[dict]:
+    return published_assets(entity_type)
+
+
+@router.get("/api/v1/media/assets/{digest}", response_class=FileResponse)
+def media_asset(digest: str) -> FileResponse:
+    item = published_file(digest)
+    if not item:
+        raise HTTPException(status_code=404, detail="Media asset not found")
+    path, media_type = item
+    return FileResponse(path, media_type=media_type, headers={
+        "Cache-Control": "public, max-age=31536000, immutable",
+        "ETag": f'"{digest}"',
+    })

apps/api/app/routers/public_data.py

@@ -0,0 +1,170 @@
+from datetime import datetime, timedelta, timezone
+
+from fastapi import APIRouter, Query
+from sqlalchemy import func, select
+from sqlalchemy.orm import joinedload
+
+from ..config import settings
+from ..dependencies import Db
+from ..models import (
+    CatchReport,
+    CommunityImportRun,
+    DataSource,
+    ExternalObservation,
+    Fish,
+    OfficialRecordImport,
+    SourceType,
+    Waterbody,
+)
+from ..schemas import (
+    ImportRunPublicOut,
+    OfficialRecordOut,
+    PaginatedOfficialRecordOut,
+    PublicObservationOut,
+    SourceStatusOut,
+)
+from ..time_utils import aware
+
+router = APIRouter()
+
+
+@router.get("/api/v1/community-observations", response_model=list[PublicObservationOut])
+def community_observations(
+    db: Db,
+    limit: int = Query(12, ge=1, le=50),
+    offset: int = Query(0, ge=0),
+    waterbody: str | None = None,
+    fish: str | None = None,
+) -> list[PublicObservationOut]:
+    query = select(ExternalObservation).join(ExternalObservation.source).options(
+        joinedload(ExternalObservation.source)
+    ).where(
+        ExternalObservation.catch_report_id.is_(None),
+        ExternalObservation.status.not_in(["rejected", "withdrawn"]),
+        DataSource.enabled.is_(True),
+    )
+    if waterbody:
+        query = query.join(ExternalObservation.waterbody).where(Waterbody.slug == waterbody)
+    if fish:
+        query = query.join(ExternalObservation.fish).where(Fish.slug == fish)
+    items = list(db.scalars(
+        query.order_by(ExternalObservation.last_seen_at.desc(), ExternalObservation.id.desc())
+        .offset(offset).limit(limit)
+    ))
+    result: list[PublicObservationOut] = []
+    for item in items:
+        missing = []
+        if item.x is None or item.y is None:
+            missing.append("координаты")
+        if item.weight_g is None:
+            missing.append("вес")
+        result.append(PublicObservationOut(
+            id=item.id,
+            source_system=item.source_system,
+            source_name=item.source.name,
+            source_url=item.source_url,
+            fish_name=item.fish_name,
+            waterbody_name=item.waterbody_name,
+            x=item.x,
+            y=item.y,
+            weight_g=item.weight_g,
+            last_seen_at=item.last_seen_at,
+            missing_fields=missing,
+            quality="incomplete" if missing else "unverified",
+        ))
+    return result
+
+
+@router.get("/api/v1/source-status", response_model=list[SourceStatusOut])
+def source_status(db: Db) -> list[SourceStatusOut]:
+    now = datetime.now(timezone.utc)
+    result = []
+    for source in db.scalars(select(DataSource).order_by(DataSource.name)):
+        runs = list(db.scalars(
+            select(CommunityImportRun)
+            .where(CommunityImportRun.source_system == source.key)
+            .order_by(CommunityImportRun.started_at.desc()).limit(20)
+        ))
+        latest = runs[0] if runs else None
+        success = next((run for run in runs if run.status == "success"), None)
+        if not source.enabled:
+            state = "disabled"
+        elif latest is None:
+            state = "waiting"
+        elif latest.status == "failed":
+            state = "source_changed" if "CommunityParseError" in (latest.error_summary or "") else "temporarily_limited"
+        elif aware(latest.started_at) < now - timedelta(seconds=settings.community_import_interval_seconds * 2):
+            state = "stale"
+        else:
+            state = "healthy"
+        result.append(SourceStatusOut(
+            source_system=source.key,
+            name=source.name,
+            status=state,
+            last_started_at=latest.started_at if latest else None,
+            last_success_at=success.started_at if success else None,
+            observations=db.scalar(
+                select(func.count()).select_from(ExternalObservation)
+                .where(ExternalObservation.source_system == source.key)
+            ) or 0,
+        ))
+    return result
+
+
+@router.get("/api/v1/records", response_model=PaginatedOfficialRecordOut)
+def records(
+    db: Db,
+    fish: str | None = None,
+    waterbody: str | None = None,
+    category: str | None = None,
+    limit: int = Query(50, ge=1, le=100),
+    offset: int = Query(0, ge=0),
+) -> PaginatedOfficialRecordOut:
+    query = select(CatchReport).options(
+        joinedload(CatchReport.fish),
+        joinedload(CatchReport.waterbody),
+        joinedload(CatchReport.bait),
+    ).where(CatchReport.source_type == SourceType.official_record)
+    if fish:
+        query = query.join(CatchReport.fish).where(Fish.slug == fish)
+    if waterbody:
+        query = query.join(CatchReport.waterbody).where(Waterbody.slug == waterbody)
+    if category:
+        query = query.where(CatchReport.raw_payload["category"].as_string() == category)
+    total = db.scalar(
+        query.with_only_columns(func.count(CatchReport.id), maintain_column_froms=True).order_by(None)
+    ) or 0
+    items = list(db.scalars(
+        query.order_by(CatchReport.caught_at.desc(), CatchReport.weight_g.desc(), CatchReport.id.desc())
+        .offset(offset).limit(limit)
+    ))
+    return PaginatedOfficialRecordOut(
+        items=[OfficialRecordOut(
+            id=item.id,
+            fish=item.fish.name_ru,
+            weight_g=item.weight_g,
+            waterbody=item.waterbody.name_ru,
+            bait=item.bait.name if item.bait else None,
+            player_name=item.player_name,
+            record_date=item.caught_at,
+            category=(item.raw_payload or {}).get("category"),
+            region=(item.raw_payload or {}).get("region"),
+            source_url=item.source_url,
+        ) for item in items],
+        total=total,
+        limit=limit,
+        offset=offset,
+    )
+
+
+@router.get("/api/v1/imports", response_model=list[ImportRunPublicOut])
+def imports(
+    db: Db,
+    limit: int = Query(20, ge=1, le=100),
+    offset: int = Query(0, ge=0),
+) -> list[OfficialRecordImport]:
+    return list(db.scalars(
+        select(OfficialRecordImport)
+        .order_by(OfficialRecordImport.started_at.desc(), OfficialRecordImport.id.desc())
+        .offset(offset).limit(limit)
+    ))

apps/api/app/routers/submissions.py

@@ -0,0 +1,125 @@
+from __future__ import annotations
+
+from datetime import datetime, timedelta, timezone
+import hashlib
+import hmac
+import json
+import logging
+import secrets
+from typing import Annotated
+from uuid import UUID
+
+from fastapi import APIRouter, File, Header, HTTPException, Request, Response, UploadFile
+from fastapi.responses import JSONResponse
+from sqlalchemy import select
+from sqlalchemy.exc import IntegrityError
+
+from ..config import settings
+from ..dependencies import Db
+from ..importer import normalize
+from ..models import Bait, BaitKind, CatchReport, Fish, ModerationStatus, SourceType, Spot, SubmissionAttempt, Waterbody
+from ..schemas import CatchReportAccepted, CatchReportCreate
+from ..storage import ScreenshotError, upload_screenshot
+from ..submission_security import check_rate_limit
+from ..tackle_components import replace_tackle_components
+from rf4_research.gear_components import from_catch_fields
+
+router = APIRouter()
+logger = logging.getLogger("rf4.api.submissions")
+
+
+@router.post("/api/v1/catch-reports", response_model=CatchReportAccepted, status_code=201)
+def create_catch_report(payload: CatchReportCreate, request: Request, db: Db, idempotency_key: Annotated[str | None, Header()] = None) -> CatchReportAccepted:
+    if payload.website:
+        raise HTTPException(status_code=400, detail="invalid submission")
+    payload_hash = hashlib.sha256(json.dumps(payload.model_dump(mode="json"), sort_keys=True, separators=(",", ":")).encode()).hexdigest()
+    key_hash = hmac.new(settings.rate_limit_secret.encode(), idempotency_key.encode(), hashlib.sha256).hexdigest() if idempotency_key else None
+    if key_hash:
+        cutoff = datetime.now(timezone.utc) - timedelta(minutes=5)
+        db.expire_all()
+        existing = db.scalar(select(SubmissionAttempt).where(SubmissionAttempt.idempotency_key == key_hash, SubmissionAttempt.created_at >= cutoff))
+        if existing is not None:
+            logger.info("idempotent hit", extra={"idempotency_key": idempotency_key[:8]})
+            if existing.payload_hash and not hmac.compare_digest(existing.payload_hash, payload_hash):
+                raise HTTPException(status_code=409, detail="Idempotency-Key was already used with different payload")
+            if existing.catch_report is None:
+                raise HTTPException(status_code=409, detail="idempotency record is incomplete; retry with a new key")
+            replay_token = _replay_token(key_hash)
+            if not hmac.compare_digest(hashlib.sha256(replay_token.encode()).hexdigest(), existing.catch_report.screenshot_upload_token_hash or ""):
+                raise HTTPException(status_code=409, detail="idempotency record token mismatch; retry with a new key")
+            return JSONResponse(status_code=200, content=_accepted(existing.catch_report, replay_token, True))
+        logger.info("idempotency check miss", extra={"idempotency_key": idempotency_key[:8]})
+    check_rate_limit(request, db, settings)
+    fish = db.scalar(select(Fish).where(Fish.slug == payload.fish_slug))
+    waterbody = db.scalar(select(Waterbody).where(Waterbody.slug == payload.waterbody_slug))
+    if fish is None or waterbody is None:
+        raise HTTPException(status_code=422, detail="unknown fish or waterbody")
+    spot = db.scalar(select(Spot).where(Spot.waterbody_id == waterbody.id, Spot.x == payload.x, Spot.y == payload.y))
+    if spot is None:
+        spot = Spot(waterbody=waterbody, x=payload.x, y=payload.y)
+        db.add(spot)
+    bait = _bait(db, payload.bait_name)
+    upload_token = _replay_token(key_hash) if key_hash else secrets.token_urlsafe(32)
+    report = CatchReport(fish=fish, spot=spot, waterbody=waterbody, bait=bait, weight_g=payload.weight_g, fishing_method=payload.fishing_method, rig_type=payload.rig_type, retrieve_method=payload.retrieve_method, retrieve_speed=payload.retrieve_speed, caught_at=payload.caught_at, reported_at=datetime.now(timezone.utc), player_name=payload.player_name, source_type=SourceType.user, source_url=payload.source_url, source_confidence=60, moderation_status=ModerationStatus.pending, raw_payload={"comment": payload.comment} if payload.comment else None, screenshot_upload_token_hash=hashlib.sha256(upload_token.encode()).hexdigest())
+    db.add(report)
+    replace_tackle_components(
+        db,
+        report,
+        from_catch_fields(bait=payload.bait_name, rig_type=payload.rig_type),
+        source_system="user",
+        source_url=payload.source_url,
+        raw_payload={"origin": "user_submission"},
+    )
+    if key_hash:
+        db.add(SubmissionAttempt(client_hash="", idempotency_key=key_hash, catch_report=report, payload_hash=payload_hash, created_at=datetime.now(timezone.utc)))
+        try:
+            db.commit()
+        except IntegrityError:
+            db.rollback()
+            winner = db.scalar(select(SubmissionAttempt).where(SubmissionAttempt.idempotency_key == key_hash))
+            if winner and winner.catch_report:
+                return JSONResponse(status_code=200, content=_accepted(winner.catch_report, _replay_token(key_hash), True))
+            raise
+        logger.info("idempotency key stored", extra={"idempotency_key": idempotency_key[:8]})
+    else:
+        db.commit()
+    return CatchReportAccepted(id=report.id, moderation_status=report.moderation_status.value, screenshot_upload_token=upload_token, idempotent=False)
+
+
+@router.post("/api/v1/catch-reports/{report_id}/screenshot", status_code=204, response_class=Response)
+def add_screenshot(report_id: UUID, db: Db, screenshot: UploadFile = File(), upload_token: Annotated[str | None, Header(alias="X-Upload-Token")] = None) -> Response:
+    report = db.get(CatchReport, report_id)
+    if report is None or report.source_type != SourceType.user or report.moderation_status != ModerationStatus.pending:
+        raise HTTPException(status_code=404, detail="pending catch report not found")
+    supplied_hash = hashlib.sha256((upload_token or "").encode()).hexdigest()
+    if not report.screenshot_upload_token_hash or not hmac.compare_digest(report.screenshot_upload_token_hash, supplied_hash):
+        raise HTTPException(status_code=401, detail="invalid screenshot upload token")
+    if report.screenshot_key:
+        raise HTTPException(status_code=409, detail="screenshot already uploaded")
+    raw = screenshot.file.read(settings.screenshot_max_bytes + 1)
+    try:
+        report.screenshot_key = upload_screenshot(raw, filename=screenshot.filename, content_type=screenshot.content_type)
+    except ScreenshotError as exc:
+        raise HTTPException(status_code=422, detail=str(exc)) from exc
+    report.screenshot_upload_token_hash = None
+    db.commit()
+    return Response(status_code=204)
+
+
+def _replay_token(key_hash: str) -> str:
+    return hmac.new(settings.rate_limit_secret.encode(), (key_hash + ":upload").encode(), hashlib.sha256).hexdigest()
+
+
+def _accepted(report: CatchReport, token: str, idempotent: bool) -> dict[str, object]:
+    return {"id": str(report.id), "moderation_status": report.moderation_status.value, "screenshot_upload_token": token, "idempotent": idempotent}
+
+
+def _bait(db: Db, value: str | None) -> Bait | None:
+    if not value or not value.strip():
+        return None
+    key = normalize(value)
+    bait = db.scalar(select(Bait).where(Bait.normalized_name == key))
+    if bait is None:
+        bait = Bait(name=value.strip(), normalized_name=key, kind=BaitKind.unknown)
+        db.add(bait)
+    return bait

apps/api/app/schemas.py

@@ -20,6 +20,16 @@ class WaterbodyOut(BaseModel):
     slug: str
     name_ru: str
     unlock_level: int | None
+    fish_species_count: int | None
+    source_system: str | None
+    source_external_id: str | None
+    source_url: str | None
+    description: str | None
+    source_aliases: list[str] | None
+    source_fish_species: list[str] | None
+    source_image_urls: list[str] | None
+    source_point_urls: list[str] | None
+    source_checked_at: datetime | None
 
 
 class BaitOut(BaseModel):
@@ -30,6 +40,48 @@ class BaitOut(BaseModel):
     kind: str
 
 
+class TackleItemOut(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+    id: UUID
+    name: str
+    category: str
+    subcategory: str | None
+    brand: str | None
+    family: str | None
+    unlock_level: int | None
+    source_system: str | None
+    source_external_id: str | None
+    source_url: str | None
+    source_checked_at: datetime | None
+    missing_fields: list[str] = Field(default_factory=list)
+
+
+class PaginatedTackleItemOut(BaseModel):
+    items: list[TackleItemOut]
+    total: int
+    limit: int
+    offset: int
+
+
+class RigComponentOut(BaseModel):
+    id: UUID
+    role: str
+    position: int
+    raw_value: str | None
+    tackle_item_id: UUID | None
+
+
+class RigOut(BaseModel):
+    id: UUID
+    name: str
+    source_system: str | None
+    source_external_id: str | None
+    source_url: str | None
+    source_checked_at: datetime | None
+    missing_fields: list[str] = Field(default_factory=list)
+    components: list[RigComponentOut]
+
+
 class ActivityOut(BaseModel):
     spot_id: UUID
     waterbody_slug: str
@@ -48,6 +100,8 @@ class ActivityOut(BaseModel):
     confidence_score: int
     explanation: str
     sources: list[str]
+    coordinate_precision: str
+    coordinate_sources: list[str]
 
 
 class PaginatedActivityOut(BaseModel):
@@ -57,6 +111,16 @@ class PaginatedActivityOut(BaseModel):
     offset: int
 
 
+class TackleCombinationOut(BaseModel):
+    role: str
+    value: str
+    catches: int
+    unique_players: int
+    last_seen_at: datetime
+    status: str
+    explanation: str
+
+
 class CatchOut(BaseModel):
     id: UUID
     fish: str
@@ -69,6 +133,18 @@ class CatchOut(BaseModel):
     retrieve_speed: int | None
     source_system: str
     source_url: str | None
+    tackle_components: list["CatchTackleComponentOut"]
+
+
+class CatchTackleComponentOut(BaseModel):
+    id: UUID
+    role: str
+    position: int
+    raw_value: str
+    tackle_item_id: UUID | None
+    rig_id: UUID | None
+    source_system: str | None
+    source_url: str | None
 
 
 class SpotOut(BaseModel):
@@ -82,6 +158,8 @@ class SpotOut(BaseModel):
     catches_3d: int
     catches_7d: int
     top_baits: list[str]
+    coordinate_precision: str
+    coordinate_sources: list[str]
 
 
 class OfficialRecordOut(BaseModel):
@@ -199,11 +277,13 @@ class AdminCatchReportOut(BaseModel):
     moderation_status: str
     comment: str | None
     screenshot_url: str | None
+    moderation_version: int
 
 
 class ModerationUpdate(BaseModel):
     status: str
     reason: str | None = Field(default=None, max_length=1000)
+    expected_version: int = Field(ge=0)
 
     @field_validator("status")
     @classmethod
@@ -226,28 +306,50 @@ class ExternalObservationOut(BaseModel):
     y: int | None
     weight_g: int | None
     published_at: datetime | None
+    first_seen_at: datetime
     last_seen_at: datetime
+    reviewed_at: datetime | None
     status: str
     fish_slug: str | None
     waterbody_slug: str | None
     catch_report_id: UUID | None
     review_note: str | None
+    missing_fields: list[str]
+    source_payload: dict[str, str | int | float | bool | None]
+    moderation_version: int
+    source_check_status: str | None
+    source_checked_at: datetime | None
 
 
 class ExternalObservationMapping(BaseModel):
     fish_slug: str
     waterbody_slug: str
     note: str | None = Field(default=None, max_length=1000)
+    expected_version: int = Field(ge=0)
 
 
 class ExternalAliasSuggestionOut(BaseModel):
     fish_slug: str | None
     waterbody_slug: str | None
+
+
+class AdminModerationHistoryOut(BaseModel):
+    entity_type: str
+    entity_id: UUID
+    decided_at: datetime
+    action: str
+    moderator: str | None
+    reason: str | None
     requires_confirmation: bool = True
 
 
 class ExternalObservationDecision(BaseModel):
     reason: str = Field(min_length=1, max_length=1000)
+    expected_version: int = Field(ge=0)
+
+
+class ExternalObservationAction(BaseModel):
+    expected_version: int = Field(ge=0)
 
 
 class ExternalObservationPublished(BaseModel):
@@ -263,3 +365,48 @@ class SourceStatusOut(BaseModel):
     last_started_at: datetime | None
     last_success_at: datetime | None
     observations: int
+
+
+class AdminSourceStatusOut(BaseModel):
+    source_system: str
+    name: str
+    status: str
+    last_started_at: datetime | None
+    last_success_at: datetime | None
+    next_allowed_at: datetime | None
+    cooldown_seconds: int
+    recent_failures_24h: int
+    backoff_recommended: bool
+
+
+class AdminMediaDerivativeOut(BaseModel):
+    role: str | None
+    format: str | None
+    width: int | None
+    height: int | None
+
+
+class AdminMediaReviewOut(BaseModel):
+    id: str
+    status: str
+    entity_type: str | None
+    entity_key: str | None
+    label: str | None
+    width: int | None
+    height: int | None
+    content_type: str | None
+    image_url: str
+    asset_url: str
+    source_system: str
+    source_url: str
+    duplicate_of: str | None
+    supersedes: str | None
+    derivatives: list[AdminMediaDerivativeOut]
+
+
+class AdminMediaDecision(BaseModel):
+    note: str = Field(min_length=1, max_length=1000)
+
+
+class AdminMediaRollback(AdminMediaDecision):
+    asset_url: str = Field(min_length=1, max_length=2000)

apps/api/app/source_lifecycle.py

@@ -0,0 +1,83 @@
+from __future__ import annotations
+
+from datetime import datetime, timezone
+from typing import Literal
+from urllib.error import HTTPError
+
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from .models import ExternalObservation, ModerationStatus
+
+
+SourceCheckStatus = Literal["available", "missing", "temporary_error", "blocked"]
+
+
+def classify_source_failure(exc: Exception) -> SourceCheckStatus:
+    """Classify the result of the scheduled request without retrying it."""
+    if isinstance(exc, HTTPError):
+        if exc.code in {404, 410}:
+            return "missing"
+        if exc.code in {401, 403, 429}:
+            return "blocked"
+    return "temporary_error"
+
+
+def record_source_check(
+    session: Session,
+    observation: ExternalObservation,
+    status: SourceCheckStatus,
+    *,
+    checked_at: datetime | None = None,
+) -> ExternalObservation:
+    """Persist a check performed during an already scheduled source request.
+
+    Only an authoritative 404/410-style ``missing`` result withdraws published
+    data. Transient errors and access blocks remain diagnostic and never remove
+    an observation from activity.
+    """
+    _apply_source_check(observation, status, checked_at or datetime.now(timezone.utc))
+    session.commit()
+    return observation
+
+
+def _apply_source_check(
+    observation: ExternalObservation,
+    status: SourceCheckStatus,
+    checked_at: datetime,
+) -> None:
+    """Mutate one observation; the caller owns the transaction boundary."""
+    current = checked_at
+    observation.source_check_status = status
+    observation.source_checked_at = current
+    if status == "missing" and observation.status != "withdrawn":
+        if observation.catch_report is not None:
+            observation.catch_report.moderation_status = ModerationStatus.pending
+        observation.status = "withdrawn"
+        observation.review_note = "Source record missing; withdrawn pending moderator review"
+        observation.reviewed_at = current
+        observation.moderation_version += 1
+
+
+def record_scheduled_source_check(
+    session: Session,
+    *,
+    source_system: str,
+    source_url: str,
+    status: SourceCheckStatus,
+    checked_at: datetime | None = None,
+) -> int:
+    """Apply one scheduled request result only to observations with that exact URL.
+
+    Aggregate pages cannot prove that an omitted record was deleted, so absence
+    from a parsed listing is deliberately ignored.
+    """
+    observations = list(session.scalars(select(ExternalObservation).where(
+        ExternalObservation.source_system == source_system,
+        ExternalObservation.source_url == source_url,
+    )))
+    current = checked_at or datetime.now(timezone.utc)
+    for observation in observations:
+        _apply_source_check(observation, status, current)
+    session.commit()
+    return len(observations)

apps/api/app/submission_security.py

@@ -0,0 +1,65 @@
+from datetime import datetime, timedelta, timezone
+import hashlib
+import hmac
+from ipaddress import IPv4Address, IPv4Network, IPv6Address, IPv6Network, ip_address
+from typing import Protocol
+
+from fastapi import HTTPException, Request
+from sqlalchemy import delete, func, select, text
+from sqlalchemy.orm import Session
+
+from .models import SubmissionAttempt
+
+
+class RateLimitConfig(Protocol):
+    rate_limit_secret: str
+    trusted_proxy_cidrs: list[str]
+
+
+def is_trusted_proxy(address: str, trusted_cidrs: list[str]) -> bool:
+    try:
+        addr = IPv4Address(address) if ":" not in address else IPv6Address(address)
+    except ValueError:
+        return False
+    for cidr in trusted_cidrs:
+        try:
+            network = IPv4Network(cidr) if ":" not in cidr else IPv6Network(cidr)
+            if addr in network:
+                return True
+        except ValueError:
+            continue
+    return False
+
+
+def client_address(request: Request, trusted_cidrs: list[str]) -> str:
+    client = request.client.host if request.client else "unknown"
+    forwarded = request.headers.get("x-forwarded-for")
+    if forwarded and request.client and is_trusted_proxy(request.client.host, trusted_cidrs):
+        candidate = forwarded.split(",")[0].strip()
+        try:
+            return str(ip_address(candidate))
+        except ValueError:
+            return client
+    return client
+
+
+def check_rate_limit(request: Request, db: Session, config: RateLimitConfig) -> None:
+    now = datetime.now(timezone.utc)
+    cutoff = now - timedelta(minutes=10)
+    client = client_address(request, config.trusted_proxy_cidrs)
+    client_hash = hmac.new(config.rate_limit_secret.encode(), client.encode(), hashlib.sha256).hexdigest()
+    if db.get_bind().dialect.name == "postgresql":
+        lock_key = int(client_hash[:16], 16) & 0x7FFF_FFFF_FFFF_FFFF
+        db.execute(text("SELECT pg_advisory_xact_lock(:lock_key)"), {"lock_key": lock_key})
+    db.execute(delete(SubmissionAttempt).where(SubmissionAttempt.created_at < now - timedelta(days=1)))
+    recent = db.scalar(
+        select(func.count()).select_from(SubmissionAttempt).where(
+            SubmissionAttempt.client_hash == client_hash,
+            SubmissionAttempt.created_at >= cutoff,
+        )
+    ) or 0
+    if recent >= 5:
+        db.commit()
+        raise HTTPException(status_code=429, detail="too many submissions")
+    db.add(SubmissionAttempt(client_hash=client_hash, created_at=now))
+    db.commit()

apps/api/app/tackle_components.py

@@ -0,0 +1,39 @@
+from __future__ import annotations
+
+from collections.abc import Iterable
+
+from sqlalchemy import delete
+from sqlalchemy.orm import Session
+
+from rf4_research.gear_components import GearComponentIdentity
+
+from .models import CatchReport, CatchTackleComponent
+
+
+def replace_tackle_components(
+    session: Session,
+    report: CatchReport,
+    components: Iterable[GearComponentIdentity],
+    *,
+    source_system: str | None,
+    source_url: str | None = None,
+    raw_payload: dict | None = None,
+) -> None:
+    """Replace the ordered evidence for a report while keeping imports idempotent."""
+    session.flush()
+    session.execute(
+        delete(CatchTackleComponent).where(CatchTackleComponent.catch_report_id == report.id)
+    )
+    session.add_all(
+        CatchTackleComponent(
+            catch_report_id=report.id,
+            role=component.role,
+            position=component.position,
+            raw_value=component.raw_value,
+            source_system=source_system,
+            source_external_id=component.source_external_id,
+            source_url=source_url,
+            raw_payload=raw_payload,
+        )
+        for component in components
+    )

apps/api/app/time_utils.py

@@ -0,0 +1,5 @@
+from datetime import datetime, timezone
+
+
+def aware(value: datetime) -> datetime:
+    return value if value.tzinfo else value.replace(tzinfo=timezone.utc)

apps/api/export_openapi.py

@@ -0,0 +1,34 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+
+from app.main import app
+
+
+TARGET = Path(__file__).with_name("openapi.json")
+
+
+def rendered_contract() -> str:
+    return json.dumps(app.openapi(), ensure_ascii=False, indent=2, sort_keys=True) + "\n"
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Generate or verify the RF4 Spotter OpenAPI contract")
+    parser.add_argument("--check", action="store_true")
+    args = parser.parse_args()
+    rendered = rendered_contract()
+    if args.check:
+        if not TARGET.exists() or TARGET.read_text(encoding="utf-8") != rendered:
+            parser.exit(1, "OpenAPI contract is stale; run apps/api/export_openapi.py\n")
+        print(f"OpenAPI contract is current: {len(app.openapi()['paths'])} paths")
+        return 0
+    TARGET.write_text(rendered, encoding="utf-8")
+    print(f"Wrote {TARGET}: {len(app.openapi()['paths'])} paths")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

apps/api/tests/test_analytics.py

@@ -0,0 +1,71 @@
+from datetime import datetime, timedelta, timezone
+
+from sqlalchemy import create_engine
+from sqlalchemy.orm import Session
+
+from app.database import Base
+from app.models import CatchReport, CatchTackleComponent, Fish, ModerationStatus, SourceType, Spot, Waterbody
+from app.routers.analytics import tackle_combinations
+
+
+def test_tackle_recommendation_requires_samples_and_independent_players() -> None:
+    now = datetime.now(timezone.utc)
+    engine = create_engine("sqlite://")
+    Base.metadata.create_all(engine)
+    with Session(engine) as db:
+        waterbody = Waterbody(slug="lake", name_ru="Озеро", unlock_level=1)
+        fish = Fish(slug="pike", name_ru="Щука", trophy_weight_g=10_000)
+        spot = Spot(waterbody=waterbody, x=10, y=20)
+        db.add_all([waterbody, fish, spot])
+        db.flush()
+        for index, player in enumerate(("One", "One", "Two")):
+            report = CatchReport(
+                fish=fish, waterbody=waterbody, spot=spot, weight_g=1000,
+                caught_at=now - timedelta(hours=1), reported_at=now - timedelta(hours=1),
+                player_name=player, source_type=SourceType.user, source_confidence=80,
+                moderation_status=ModerationStatus.approved,
+            )
+            report.tackle_components.append(CatchTackleComponent(role="lure", position=0, raw_value="Spinner #1"))
+            db.add(report)
+        db.commit()
+
+        rows = tackle_combinations(db, waterbody="lake", fish="pike", method=None, hours=72, min_samples=3, min_players=2)
+        assert len(rows) == 1
+        assert (rows[0].status, rows[0].catches, rows[0].unique_players) == ("recommendation", 3, 2)
+
+        rows = tackle_combinations(db, waterbody="lake", fish="pike", method=None, hours=72, min_samples=3, min_players=3)
+        assert rows[0].status == "insufficient_data"
+
+    engine.dispose()
+
+
+def test_tackle_analytics_handles_empty_and_multicomponent_observations() -> None:
+    now = datetime.now(timezone.utc)
+    engine = create_engine("sqlite://")
+    Base.metadata.create_all(engine)
+    with Session(engine) as db:
+        waterbody = Waterbody(slug="empty-check", name_ru="Проверка", unlock_level=1)
+        fish = Fish(slug="perch", name_ru="Окунь", trophy_weight_g=5_000)
+        spot = Spot(waterbody=waterbody, x=1, y=2)
+        report = CatchReport(
+            fish=fish, waterbody=waterbody, spot=spot, weight_g=500,
+            caught_at=now, reported_at=now, player_name="Player",
+            source_type=SourceType.user, source_confidence=80,
+            moderation_status=ModerationStatus.approved,
+        )
+        report.tackle_components.extend([
+            CatchTackleComponent(role="lure", position=0, raw_value="Spinner #1"),
+            CatchTackleComponent(role="rig", position=1, raw_value="Rig #1"),
+            CatchTackleComponent(role="lure", position=2, raw_value="Spinner #1"),
+            CatchTackleComponent(role="lure", position=3, raw_value="  "),
+        ])
+        db.add(report)
+        db.commit()
+
+        rows = tackle_combinations(db, waterbody="empty-check", fish="perch", method=None, hours=72, min_samples=1, min_players=1)
+        assert {(row.role, row.value, row.catches) for row in rows} == {
+            ("lure", "Spinner #1", 1), ("rig", "Rig #1", 1),
+        }
+        assert tackle_combinations(db, waterbody="missing", fish=None, method=None, hours=72) == []
+
+    engine.dispose()

apps/api/tests/test_api.py

@@ -12,7 +12,8 @@ from app.database import Base, get_session
 from app.community_importer import stage_observations
 from app.importer import ImportAlreadyRunning
 from app.main import app
-from app.models import Bait, BaitKind, CatchReport, DataSource, ExternalEntityAlias, ExternalObservation, Fish, ImportStatus, ModerationEvent, ModerationStatus, OfficialRecordImport, SourceType, Spot, SubmissionAttempt, Waterbody
+from app.models import Bait, BaitKind, CatchReport, CatchTackleComponent, DataSource, ExternalEntityAlias, ExternalObservation, Fish, ImportStatus, ModerationEvent, ModerationStatus, OfficialRecordImport, SourceType, Spot, SubmissionAttempt, Waterbody
+from app.routers import admin as admin_router
 
 
 engine = create_engine("sqlite://", connect_args={"check_same_thread": False}, poolclass=StaticPool)
@@ -56,11 +57,37 @@ def test_activity_filters_and_explains_score() -> None:
     assert payload["items"][0]["sources"] == ["manual-import"]
 
 
+def test_waterbody_catalog_exposes_nullable_source_provenance() -> None:
+    response = client.get("/api/v1/waterbodies")
+    assert response.status_code == 200
+    item = next(row for row in response.json() if row["slug"] == "test-lake")
+    assert item["source_system"] is None
+    assert item["source_external_id"] is None
+    assert item["source_url"] is None
+    assert item["description"] is None
+    assert item["source_checked_at"] is None
+
+
 def test_invalid_period_is_rejected() -> None:
     assert client.get("/api/v1/activity?hours=13").status_code == 422
     assert client.get("/api/v1/activity?sort=unknown").status_code == 422
 
 
+def test_published_media_catalog_and_content_addressed_file() -> None:
+    catalog = client.get("/api/v1/media/catalog?entity_type=fish")
+    assert catalog.status_code == 200
+    assert catalog.json()
+    item = catalog.json()[0]
+    image = client.get(item["image_url"])
+    assert image.status_code == 200
+    assert image.headers["content-type"].startswith("image/")
+    assert image.headers["cache-control"] == "public, max-age=31536000, immutable"
+    variant = client.get(item["variants"][0]["url"])
+    assert variant.status_code == 200
+    assert variant.headers["content-type"].startswith("image/")
+    assert client.get("/api/v1/media/assets/not-a-hash").status_code == 404
+
+
 def test_review_queue_filters_before_pagination() -> None:
     with Session(engine) as db:
         stage_observations(db, [{
@@ -139,6 +166,54 @@ def test_public_source_status_hides_internal_details() -> None:
     assert all("error_summary" not in item and "source_url" not in item for item in response.json())
 
 
+def test_admin_source_status_requires_auth_and_exposes_safe_cooldown_fields() -> None:
+    assert client.get("/api/v1/admin/source-status").status_code == 401
+    response = client.get("/api/v1/admin/source-status", headers={"Authorization": "Bearer change-me-in-production"})
+    assert response.status_code == 200
+    assert response.json()
+    assert all({"status", "cooldown_seconds", "recent_failures_24h", "backoff_recommended"} <= set(item) for item in response.json())
+    assert all({"source_system", "name", "last_started_at", "last_success_at", "next_allowed_at"} <= set(item) for item in response.json())
+    assert all("error_summary" not in item and "base_url" not in item for item in response.json())
+
+
+def test_admin_media_review_requires_auth() -> None:
+    assert client.get("/api/v1/admin/media/catalog").status_code == 401
+    response = client.get("/api/v1/admin/media/catalog?status=approved&limit=2", headers={"Authorization": "Bearer change-me-in-production"})
+    assert response.status_code == 200
+    assert len(response.json()) <= 2
+    if response.json():
+        assert {"status", "width", "height", "source_system", "source_url", "derivatives"} <= set(response.json()[0])
+        assert all({"role", "format", "width", "height"} <= set(derivative) for derivative in response.json()[0]["derivatives"])
+
+
+def test_admin_media_decisions_require_auth_and_note(monkeypatch) -> None:
+    assert client.post("/api/v1/admin/media/upgrades/publish", json={"note": "publish"}).status_code == 401
+    assert client.post("/api/v1/admin/media/upgrades/rollback", json={"asset_url": "https://example.test/a", "note": "rollback"}).status_code == 401
+
+    monkeypatch.setattr(admin_router, "publish_quality_upgrades", lambda path, note: {"published": 2, "retained_fallbacks": 2})
+    publish = client.post(
+        "/api/v1/admin/media/upgrades/publish",
+        json={"note": "visual review complete"},
+        headers={"Authorization": "Bearer change-me-in-production"},
+    )
+    assert publish.status_code == 200
+    assert publish.json() == {"published": 2, "retained_fallbacks": 2}
+
+    monkeypatch.setattr(admin_router, "rollback_quality_upgrade", lambda path, asset_url, note: {"rolled_back": asset_url, "restored": "https://example.test/fallback"})
+    rollback = client.post(
+        "/api/v1/admin/media/upgrades/rollback",
+        json={"asset_url": "https://example.test/a", "note": "fallback is preferred"},
+        headers={"Authorization": "Bearer change-me-in-production"},
+    )
+    assert rollback.status_code == 200
+    assert rollback.json()["rolled_back"] == "https://example.test/a"
+    assert client.post(
+        "/api/v1/admin/media/upgrades/publish",
+        json={"note": ""},
+        headers={"Authorization": "Bearer change-me-in-production"},
+    ).status_code == 422
+
+
 def test_liveness_does_not_probe_dependencies() -> None:
     response = client.get("/health?token=must-not-be-logged")
     assert response.json() == {"status": "ok"}
@@ -158,6 +233,17 @@ def test_admin_diagnostics_exposes_build_identity_only_to_admin() -> None:
     serialized = response.text.lower()
     for forbidden in ("player_name", "source_url", "error_summary", "raw_payload", "admin_token", "s3_"):
         assert forbidden not in serialized
+    assert client.get("/api/v1/admin/moderation-history").status_code == 401
+    history = client.get("/api/v1/admin/moderation-history", headers={"Authorization": "Bearer change-me-in-production"})
+    assert history.status_code == 200
+    for forbidden in ("player_name", "source_url", "raw_payload", "screenshot"):
+        assert forbidden not in history.text.lower()
+    export = client.get("/api/v1/admin/moderation-history-export", headers={"Authorization": "Bearer change-me-in-production"})
+    assert export.status_code == 200
+    assert export.headers["Content-Disposition"] == "attachment; filename=rf4spotter-moderation-history.json"
+    assert set(export.json()) == {"generated_at", "count", "events"}
+    for forbidden in ("entity_id", "moderator", "reason", "player_name", "source_url", "raw_payload"):
+        assert forbidden not in export.text.lower()
 
 
 def test_spot_detail_and_catches() -> None:
@@ -265,18 +351,24 @@ def test_records_pagination_returns_correct_total_and_offset() -> None:
 
 
 def test_user_report_requires_moderation_before_activity() -> None:
-    created = client.post("/api/v1/catch-reports", json={"fish_slug": "pike", "waterbody_slug": "test-lake", "x": 77, "y": 88, "weight_g": 5500, "bait_name": "Новая приманка", "player_name": "Reporter"})
+    created = client.post("/api/v1/catch-reports", json={"fish_slug": "pike", "waterbody_slug": "test-lake", "x": 77, "y": 88, "weight_g": 5500, "bait_name": "Новая приманка", "rig_type": "Спиннинг", "player_name": "Reporter"})
     assert created.status_code == 201
     assert created.headers["Cache-Control"] == "no-store"
     assert created.json()["moderation_status"] == "pending"
     report_id = created.json()["id"]
+    with Session(engine) as db:
+        components = db.scalars(select(CatchTackleComponent).where(CatchTackleComponent.catch_report_id == UUID(report_id)).order_by(CatchTackleComponent.position)).all()
+        assert [(component.role, component.raw_value) for component in components] == [("lure", "Новая приманка"), ("rig", "Спиннинг")]
     headers = {"Authorization": "Bearer change-me-in-production"}
     pending = client.get("/api/v1/admin/catch-reports", headers=headers)
     assert pending.status_code == 200
     assert pending.headers["Cache-Control"] == "no-store"
     assert any(item["id"] == report_id for item in pending.json())
-    approved = client.patch(f"/api/v1/admin/catch-reports/{report_id}", headers=headers, json={"status": "approved", "reason": "fixture verified"})
+    approved = client.patch(f"/api/v1/admin/catch-reports/{report_id}", headers=headers, json={"status": "approved", "reason": "fixture verified", "expected_version": 0})
     assert approved.status_code == 200
+    stale = client.patch(f"/api/v1/admin/catch-reports/{report_id}", headers=headers, json={"status": "rejected", "reason": "stale tab", "expected_version": 0})
+    assert stale.status_code == 409
+    assert "reload" in stale.json()["detail"]
     activity = client.get("/api/v1/activity?waterbody=test-lake&fish=pike&hours=24").json()
     assert any(item["x"] == 77 and item["catches"] == 1 for item in activity["items"])
 
@@ -301,19 +393,19 @@ def test_external_observation_requires_mapping_and_complete_data_before_publicat
             ExternalObservation.source_external_id == "review-complete"
         ))
     headers = {"Authorization": "Bearer change-me-in-production"}
-    premature = client.post(f"/api/v1/admin/external-observations/{observation_id}/publish", headers=headers)
+    premature = client.post(f"/api/v1/admin/external-observations/{observation_id}/publish", headers=headers, json={"expected_version": 0})
     assert premature.status_code == 409
     mapped = client.patch(
         f"/api/v1/admin/external-observations/{observation_id}/mapping", headers=headers,
-        json={"fish_slug": "pike", "waterbody_slug": "test-lake", "note": "verified fixture"},
+        json={"fish_slug": "pike", "waterbody_slug": "test-lake", "note": "verified fixture", "expected_version": 0},
     )
     assert mapped.status_code == 200
     assert mapped.json()["status"] == "ready"
-    published = client.post(f"/api/v1/admin/external-observations/{observation_id}/publish", headers=headers)
+    published = client.post(f"/api/v1/admin/external-observations/{observation_id}/publish", headers=headers, json={"expected_version": 1})
     assert published.status_code == 200
     assert published.json()["status"] == "published"
-    repeated = client.post(f"/api/v1/admin/external-observations/{observation_id}/publish", headers=headers)
-    assert repeated.json()["catch_report_id"] == published.json()["catch_report_id"]
+    repeated = client.post(f"/api/v1/admin/external-observations/{observation_id}/publish", headers=headers, json={"expected_version": 1})
+    assert repeated.status_code == 409
     with Session(engine) as db:
         observation = db.get(ExternalObservation, observation_id)
         report = db.get(CatchReport, observation.catch_report_id)
@@ -339,17 +431,28 @@ def test_incomplete_external_observation_is_publicly_labelled_but_not_counted()
     assert signal["source_system"] == "rf4db"
     assert signal["quality"] == "incomplete"
     assert signal["missing_fields"] == ["вес"]
-    assert all(item["x"] != 32 or item["y"] != 42 for item in client.get("/api/v1/activity").json()["items"])
     headers = {"Authorization": "Bearer change-me-in-production"}
+    incomplete = client.get("/api/v1/admin/external-observations?status=review&completeness=incomplete&q=Pike", headers=headers)
+    assert any(item["id"] == str(observation_id) for item in incomplete.json())
+    provenance = next(item for item in incomplete.json() if item["id"] == str(observation_id))
+    assert provenance["missing_fields"] == ["weight_g"]
+    assert provenance["first_seen_at"] and provenance["last_seen_at"]
+    assert set(provenance["source_payload"]) <= {"bait", "fishing_method", "rig_type", "retrieve_method", "retrieve_speed", "player_name", "published_at", "region", "category"}
+    complete = client.get("/api/v1/admin/external-observations?status=review&completeness=complete&q=Pike", headers=headers)
+    assert all(item["id"] != str(observation_id) for item in complete.json())
+    prioritized = client.get("/api/v1/admin/external-observations?status=review&order=risk", headers=headers)
+    assert prioritized.status_code == 200
+    assert prioritized.json()[0]["weight_g"] is None
+    assert all(item["x"] != 32 or item["y"] != 42 for item in client.get("/api/v1/activity").json()["items"])
     mapped = client.patch(
         f"/api/v1/admin/external-observations/{observation_id}/mapping", headers=headers,
-        json={"fish_slug": "pike", "waterbody_slug": "test-lake"},
+        json={"fish_slug": "pike", "waterbody_slug": "test-lake", "expected_version": 0},
     )
     assert mapped.json()["status"] == "mapped"
-    assert client.post(f"/api/v1/admin/external-observations/{observation_id}/publish", headers=headers).status_code == 409
+    assert client.post(f"/api/v1/admin/external-observations/{observation_id}/publish", headers=headers, json={"expected_version": 1}).status_code == 409
     rejected = client.patch(
         f"/api/v1/admin/external-observations/{observation_id}/reject", headers=headers,
-        json={"reason": "weight is absent"},
+        json={"reason": "weight is absent", "expected_version": 1},
     )
     assert rejected.json()["status"] == "rejected"
     assert all(item["id"] != str(observation_id) for item in client.get("/api/v1/community-observations").json())
@@ -371,7 +474,7 @@ def test_admin_can_start_and_list_official_import(monkeypatch) -> None:
         db.refresh(run)
         return run
 
-    monkeypatch.setattr("app.main.import_records", fake_import)
+    monkeypatch.setattr("app.routers.admin.import_records", fake_import)
     headers = {"Authorization": "Bearer change-me-in-production"}
     started = client.post("/api/v1/admin/imports/official-records", headers=headers)
     assert started.status_code == 201
@@ -382,14 +485,14 @@ def test_admin_can_start_and_list_official_import(monkeypatch) -> None:
     def busy_import(*args, **kwargs):
         raise ImportAlreadyRunning("official import is already running")
 
-    monkeypatch.setattr("app.main.import_records", busy_import)
+    monkeypatch.setattr("app.routers.admin.import_records", busy_import)
     conflict = client.post("/api/v1/admin/imports/official-records", headers=headers)
     assert conflict.status_code == 409
 
 
 def test_pending_report_accepts_one_validated_screenshot(monkeypatch) -> None:
     created = client.post("/api/v1/catch-reports", json={"fish_slug": "pike", "waterbody_slug": "test-lake", "x": 91, "y": 92, "weight_g": 4200}).json()
-    monkeypatch.setattr("app.main.upload_screenshot", lambda raw, **metadata: "reports/test.jpg" if raw == b"image-bytes" and metadata == {"filename": "catch.jpg", "content_type": "image/jpeg"} else "unexpected")
+    monkeypatch.setattr("app.routers.submissions.upload_screenshot", lambda raw, **metadata: "reports/test.jpg" if raw == b"image-bytes" and metadata == {"filename": "catch.jpg", "content_type": "image/jpeg"} else "unexpected")
     upload_url = f"/api/v1/catch-reports/{created['id']}/screenshot"
     assert client.post(upload_url, files={"screenshot": ("catch.jpg", b"image-bytes", "image/jpeg")}).status_code == 401
     assert client.post(upload_url, headers={"X-Upload-Token": "wrong"}, files={"screenshot": ("catch.jpg", b"image-bytes", "image/jpeg")}).status_code == 401
@@ -406,9 +509,9 @@ def test_admin_delete_anonymizes_report_removes_screenshot_and_keeps_audit(monke
         report.screenshot_key = "reports/private.jpg"
         db.commit()
     deleted_keys: list[str] = []
-    monkeypatch.setattr("app.main.delete_screenshot", deleted_keys.append)
+    monkeypatch.setattr("app.routers.admin.delete_screenshot", deleted_keys.append)
     headers = {"Authorization": "Bearer change-me-in-production"}
-    response = client.delete(f"/api/v1/admin/catch-reports/{created['id']}", headers=headers)
+    response = client.delete(f"/api/v1/admin/catch-reports/{created['id']}?expected_version=0", headers=headers)
     assert response.status_code == 204
     assert deleted_keys == ["reports/private.jpg"]
     with Session(engine) as db:
@@ -420,7 +523,7 @@ def test_admin_delete_anonymizes_report_removes_screenshot_and_keeps_audit(monke
         event = db.query(ModerationEvent).filter_by(catch_report_id=report.id).order_by(ModerationEvent.created_at.desc()).first()
         assert event is not None
         assert event.reason == "user report deleted and anonymized"
-    assert client.delete(f"/api/v1/admin/catch-reports/{created['id']}", headers=headers).status_code == 404
+    assert client.delete(f"/api/v1/admin/catch-reports/{created['id']}?expected_version=0", headers=headers).status_code == 404
 
 
 def test_catch_report_idempotency_key_prevents_duplicates(monkeypatch) -> None:

apps/api/tests/test_catalog_audit.py

@@ -3,7 +3,7 @@ from datetime import datetime, timezone
 from sqlalchemy import create_engine
 from sqlalchemy.orm import Session
 
-from app.catalog_audit import audit_catalog
+from app.catalog_audit import audit_catalog, audit_waterbody_catalog
 from app.database import Base
 from app.models import CatchReport, Fish, ModerationStatus, SourceType, Spot, Waterbody
 
@@ -24,3 +24,24 @@ def test_catalog_audit_checks_the_whole_catalog() -> None:
         assert result["reports"] == 1
         assert result["invalid_coordinates"] == 1
         assert result["failures"] == 1
+
+
+def test_waterbody_catalog_audit_reports_snapshot_gaps_without_legacy_rows() -> None:
+    engine = create_engine("sqlite://")
+    Base.metadata.create_all(engine)
+    with Session(engine) as db:
+        now = datetime.now(timezone.utc)
+        db.add_all([
+            Waterbody(
+                slug="lake", name_ru="Озеро", source_system="rf4db",
+                source_external_id="level_001_lake", source_url="https://rf4db.com/ru/maps/level_001_lake",
+                source_checked_at=now,
+            ),
+            Waterbody(slug="legacy", name_ru="Старое озеро"),
+        ])
+        db.commit()
+        result = audit_waterbody_catalog(db, {"level_001_lake", "level_002_river"})
+        assert result["expected"] == 2
+        assert result["observed"] == 1
+        assert result["missing_source_external_ids"] == ["level_002_river"]
+        assert result["failures"] == 1

apps/api/tests/test_catch_tackle_components.py

@@ -0,0 +1,31 @@
+from datetime import datetime, timezone
+
+from sqlalchemy import create_engine
+from sqlalchemy.orm import Session
+
+from app.database import Base
+from app.models import CatchReport, CatchTackleComponent, Fish, ModerationStatus, SourceType, Waterbody
+
+
+def test_catch_keeps_ordered_unresolved_gear_evidence() -> None:
+    engine = create_engine("sqlite:///:memory:")
+    Base.metadata.create_all(engine)
+    with Session(engine) as session:
+        fish = Fish(slug="pike", name_ru="Щука")
+        waterbody = Waterbody(slug="lake", name_ru="Озеро")
+        report = CatchReport(
+            fish=fish, waterbody=waterbody, weight_g=1000,
+            reported_at=datetime(2026, 9, 20, tzinfo=timezone.utc), source_type=SourceType.manual_import,
+            source_confidence=50, moderation_status=ModerationStatus.pending,
+        )
+        report.tackle_components.extend([
+            CatchTackleComponent(role="lure", position=0, raw_value="Spiker #2"),
+            CatchTackleComponent(role="rig", position=1, raw_value="Method Popup"),
+        ])
+        session.add(report)
+        session.commit()
+        saved = session.get(CatchReport, report.id)
+        assert saved is not None
+        assert [(row.position, row.role, row.raw_value) for row in saved.tackle_components] == [
+            (0, "lure", "Spiker #2"), (1, "rig", "Method Popup"),
+        ]

apps/api/tests/test_community_importer.py

@@ -7,10 +7,11 @@ import pytest
 from sqlalchemy import create_engine, func, select
 from sqlalchemy.orm import Session
 
-from app.community_importer import CommunityImportError, stage_observations
+from app.community_importer import CommunityImportError, stage_observations, update_waterbody_detail, update_waterbody_details, upsert_waterbody_catalog
 from app.community_review import ExternalReviewError, map_observation, publish_observation, suggest_aliases
+from app.source_lifecycle import record_scheduled_source_check, record_source_check
 from app.database import Base
-from app.models import CatchReport, DataSource, ExternalEntityAlias, ExternalObservation, Fish, Waterbody
+from app.models import CatchReport, CatchTackleComponent, DataSource, ExternalEntityAlias, ExternalObservation, Fish, Waterbody
 from rf4_research.community_sources import parse_rf4db_catches, parse_rf4map_point, parse_rf4posts_spot
 
 
@@ -41,6 +42,20 @@ def record(source: str = "rf4db", external_id: str = "catch-1") -> dict[str, obj
     }
 
 
+def waterbody_row(**overrides: object) -> dict[str, object]:
+    row: dict[str, object] = {
+        "source_system": "rf4db",
+        "source_external_id": "level_001_mosquito",
+        "source_url": "https://rf4db.com/ru/maps/level_001_mosquito",
+        "name": "оз. Комариное",
+        "unlock_level": 1,
+        "unlock_label": "1",
+        "fish_species_count": 20,
+    }
+    row.update(overrides)
+    return row
+
+
 @pytest.fixture
 def db() -> Session:
     engine = create_engine("sqlite://")
@@ -68,6 +83,77 @@ def test_staging_is_idempotent_and_preserves_first_seen(db: Session) -> None:
     assert source is not None and source.enabled is True
 
 
+def test_waterbody_catalog_upsert_is_idempotent_and_non_destructive(db: Session) -> None:
+    first = datetime(2026, 9, 16, 10, tzinfo=timezone.utc)
+    assert upsert_waterbody_catalog(db, [waterbody_row()], fetched_at=first) == (1, 0)
+    item = db.scalar(select(Waterbody).where(Waterbody.source_external_id == "level_001_mosquito"))
+    assert item is not None
+    assert item.slug == "оз-комариное"
+    assert item.source_checked_at.replace(tzinfo=timezone.utc) == first
+    assert item.fish_species_count == 20
+
+    assert upsert_waterbody_catalog(db, [waterbody_row(name="Озеро Комариное", unlock_level=2)], fetched_at=first) == (0, 1)
+    item = db.scalar(select(Waterbody).where(Waterbody.source_external_id == "level_001_mosquito"))
+    assert item is not None
+    assert (item.name_ru, item.unlock_level, item.fish_species_count) == ("Озеро Комариное", 2, 20)
+    assert db.scalar(select(Waterbody).where(Waterbody.name_ru == "оз. Комариное")) is None
+
+
+def test_waterbody_catalog_rejects_untrusted_source(db: Session) -> None:
+    with pytest.raises(CommunityImportError, match="source_url"):
+        upsert_waterbody_catalog(db, [waterbody_row(source_url="https://example.test/map")])
+
+
+def test_waterbody_detail_updates_only_imported_identity_without_media_roles(db: Session) -> None:
+    upsert_waterbody_catalog(db, [waterbody_row()])
+    assert update_waterbody_detail(db, {
+        "source_system": "rf4db",
+        "source_external_id": "level_001_mosquito",
+        "source_url": "https://rf4db.com/ru/maps/level_001_mosquito",
+        "name": "оз. Комариное",
+        "description": "Каменистые берега.",
+        "aliases": ["Комариное", "Комариное"],
+        "fish_species": ["Щука", "Окунь"],
+        "image_urls": ["https://oss.rf4db.com/map.webp"],
+        "point_urls": ["https://rf4db.com/ru/maps/level_001_mosquito/spots/12-34"],
+    }) is True
+    item = db.scalar(select(Waterbody).where(Waterbody.source_external_id == "level_001_mosquito"))
+    assert item is not None
+    assert item.source_aliases == ["Комариное"]
+    assert item.source_fish_species == ["Щука", "Окунь"]
+    assert item.source_image_urls == ["https://oss.rf4db.com/map.webp"]
+
+
+def test_waterbody_detail_accepts_authorized_download_subdomain(db: Session) -> None:
+    upsert_waterbody_catalog(db, [waterbody_row()])
+    assert update_waterbody_detail(db, {
+        "source_system": "rf4db",
+        "source_external_id": "level_001_mosquito",
+        "source_url": "https://download.rf4db.com/ru/maps/level_001_mosquito",
+        "name": "оз. Комариное",
+        "description": None,
+        "aliases": [],
+        "fish_species": ["Щука"],
+        "image_urls": [],
+        "point_urls": [],
+    }) is True
+
+
+def test_waterbody_detail_batch_validates_before_writing(db: Session) -> None:
+    upsert_waterbody_catalog(db, [waterbody_row()])
+    valid = {
+        "source_system": "rf4db", "source_external_id": "level_001_mosquito",
+        "source_url": "https://rf4db.com/ru/maps/level_001_mosquito", "name": "оз. Комариное",
+        "description": "Описание", "aliases": [], "fish_species": ["Щука"],
+        "image_urls": [], "point_urls": [],
+    }
+    invalid = valid | {"source_external_id": "unknown", "source_url": "https://example.test/map"}
+    with pytest.raises(CommunityImportError, match="source_url"):
+        update_waterbody_details(db, [valid, invalid])
+    item = db.scalar(select(Waterbody).where(Waterbody.source_external_id == "level_001_mosquito"))
+    assert item is not None and item.description is None
+
+
 def test_external_ids_are_isolated_by_source(db: Session) -> None:
     created, updated = stage_observations(db, [record("rf4db"), record("rf4stat-fishing")])
 
@@ -103,14 +189,28 @@ def test_complete_observation_with_reviewed_aliases_is_published(db: Session) ->
     assert item.catch_report is not None
     assert item.catch_report.fish_id == fish.id
     assert item.catch_report.waterbody_id == waterbody.id
-    assert db.scalar(select(func.count()).select_from(CatchReport)) == 1
-
     assert stage_observations(db, [record() | {"weight_g": 5_000}]) == (0, 1)
     db.refresh(item)
     assert item.status == "published"
     assert db.scalar(select(func.count()).select_from(CatchReport)) == 1
 
 
+def test_observation_preserves_coordinate_text_and_precision(db: Session) -> None:
+    stage_observations(db, [record() | {
+        "source_external_id": "coordinate-area",
+        "x": None, "y": None, "coordinate_raw": "северная бухта",
+        "coordinate_precision": "area", "weight_g": None,
+    }])
+    item = db.scalar(select(ExternalObservation).where(ExternalObservation.source_external_id == "coordinate-area"))
+    assert item is not None
+    assert (item.coordinate_raw, item.coordinate_precision, item.x, item.y) == ("северная бухта", "area", None, None)
+
+
+def test_coordinate_precision_rejects_unknown_value(db: Session) -> None:
+    with pytest.raises(CommunityImportError, match="invalid coordinate_precision"):
+        stage_observations(db, [record() | {"coordinate_precision": "guess"}])
+
+
 def test_changed_published_record_requires_review_and_reuses_report(db: Session) -> None:
     fish = Fish(slug="pike", name_ru="Щука")
     water = Waterbody(slug="test-lake", name_ru="Тестовое озеро")
@@ -128,6 +228,8 @@ def test_changed_published_record_requires_review_and_reuses_report(db: Session)
     assert report.moderation_status.value == "pending"
     assert report.weight_g == 5000
     assert item.weight_g == 6000
+    assert item.moderation_version == 1
+    assert item.reviewed_at is not None
     stage_observations(db, [record() | {"weight_g": 6000}])
     assert item.status == "staged"
     with pytest.raises(ExternalReviewError):
@@ -137,9 +239,83 @@ def test_changed_published_record_requires_review_and_reuses_report(db: Session)
     assert updated.id == report_id
     assert updated.weight_g == 6000
     assert updated.moderation_status.value == "approved"
+    components = db.scalars(select(CatchTackleComponent).order_by(CatchTackleComponent.position)).all()
+    assert [(component.position, component.raw_value) for component in components] == [(0, "Приманка")]
     assert db.scalar(select(func.count()).select_from(CatchReport)) == 1
 
 
+def test_missing_source_withdraws_published_record_until_manual_review(db: Session) -> None:
+    fish = Fish(slug="pike", name_ru="Щука")
+    water = Waterbody(slug="test-lake", name_ru="Тестовое озеро")
+    db.add_all([fish, water])
+    db.commit()
+    seen = datetime(2026, 9, 13, 8, tzinfo=timezone.utc)
+    checked = datetime(2026, 9, 13, 9, tzinfo=timezone.utc)
+    stage_observations(db, [record() | {"weight_g": 5000}], fetched_at=seen)
+    item = db.scalar(select(ExternalObservation))
+    assert item is not None and item.catch_report is not None
+
+    record_source_check(db, item, "missing", checked_at=checked)
+
+    assert item.status == "withdrawn"
+    assert item.source_check_status == "missing"
+    assert item.source_checked_at.replace(tzinfo=timezone.utc) == checked
+    assert item.catch_report.moderation_status.value == "pending"
+    assert item.moderation_version == 1
+
+    stage_observations(db, [record() | {"weight_g": 5000}], fetched_at=checked)
+    assert item.status == "staged"
+    assert item.source_check_status == "available"
+    assert item.catch_report.moderation_status.value == "pending"
+    assert "reappeared" in (item.review_note or "")
+
+
+@pytest.mark.parametrize("status", ["temporary_error", "blocked"])
+def test_non_authoritative_source_failures_do_not_withdraw(db: Session, status: str) -> None:
+    fish = Fish(slug="pike", name_ru="Щука")
+    water = Waterbody(slug="test-lake", name_ru="Тестовое озеро")
+    db.add_all([fish, water])
+    db.commit()
+    stage_observations(db, [record() | {"weight_g": 5000}])
+    item = db.scalar(select(ExternalObservation))
+    assert item is not None and item.catch_report is not None
+
+    record_source_check(db, item, status)  # type: ignore[arg-type]
+
+    assert item.status == "published"
+    assert item.catch_report.moderation_status.value == "approved"
+    assert item.source_check_status == status
+
+
+def test_scheduled_failure_only_affects_exact_source_url(db: Session) -> None:
+    stage_observations(db, [
+        record(external_id="matching"),
+        record(external_id="other") | {"source_url": "https://rf4db.com/catches/other"},
+    ])
+
+    affected = record_scheduled_source_check(
+        db,
+        source_system="rf4db",
+        source_url="https://rf4db.com/ru/catches/matching",
+        status="missing",
+    )
+    items = {item.source_external_id: item for item in db.scalars(select(ExternalObservation))}
+
+    assert affected == 1
+    assert items["matching"].status == "withdrawn"
+    assert items["other"].status != "withdrawn"
+    assert items["other"].source_check_status == "available"
+
+    record_scheduled_source_check(
+        db,
+        source_system="rf4db",
+        source_url="https://rf4db.com/ru/catches/matching",
+        status="available",
+    )
+    assert items["matching"].source_check_status == "available"
+    assert items["matching"].status == "withdrawn"
+
+
 def test_auto_publication_requires_enabled_source(db: Session) -> None:
     source = DataSource(key="rf4db", name="RF4DB", base_url="https://rf4db.com", default_confidence=70, enabled=False)
     fish = Fish(slug="pike", name_ru="Щука")

apps/api/tests/test_community_scheduler.py

@@ -1,10 +1,12 @@
 import pytest
 from pydantic import ValidationError
+from urllib.error import HTTPError
 
 from datetime import datetime, timedelta, timezone
 
 from app.community_scheduler import MAX_BACKOFF_SECONDS, configured_sources, _static_registry, oldest_site_source, retry_delay
 from app.config import Settings
+from app.source_lifecycle import classify_source_failure
 
 
 def test_all_authorized_sources_are_scheduled() -> None:
@@ -23,6 +25,16 @@ def test_failed_runs_back_off_but_success_resets_delay() -> None:
     assert retry_delay(["success", "failed"]) == 1800
 
 
+@pytest.mark.parametrize(("code", "expected"), [(404, "missing"), (410, "missing"), (403, "blocked"), (429, "blocked"), (500, "temporary_error")])
+def test_source_http_failure_classification(code: int, expected: str) -> None:
+    error = HTTPError("https://rf4.example/source", code, "failure", {}, None)
+    assert classify_source_failure(error) == expected
+
+
+def test_non_http_source_failure_is_temporary() -> None:
+    assert classify_source_failure(TimeoutError("timeout")) == "temporary_error"
+
+
 def test_same_site_endpoints_rotate_by_oldest_attempt() -> None:
     now = datetime.now(timezone.utc)
     all_keys = {"rf4db", "rf4stat-fishing", "rf4stat-post", "rf4map", "rf4posts-spot"}

apps/api/tests/test_importer.py

@@ -8,7 +8,7 @@ from sqlalchemy.orm import Session
 
 from app.database import Base
 from app.importer import FetchResult, ImportAlreadyRunning, ImportSourceError, _lock_key, _official_import_lock, import_records, parse_html
-from app.models import CatchReport, ImportStatus, OfficialRecordImport, SourceType
+from app.models import CatchReport, CatchTackleComponent, ImportStatus, OfficialRecordImport, SourceType
 
 
 FIXTURE = Path(__file__).parents[3] / "tests" / "fixtures" / "records_ru_sample.html"
@@ -50,6 +50,7 @@ def test_parser_and_import_are_idempotent() -> None:
         # A12: Second import of identical data creates no events (no fields changed)
         assert (second.rows_created, second.rows_updated) == (0, 0)
         assert db.scalar(select(func.count()).select_from(CatchReport).where(CatchReport.source_type == SourceType.official_record)) == 2
+        assert db.scalar(select(func.count()).select_from(CatchTackleComponent)) == 2
         assert db.scalar(select(func.count()).select_from(OfficialRecordImport)) == 2
 
 

apps/api/tests/test_rate_limit.py

@@ -9,8 +9,51 @@ from sqlalchemy import create_engine, select
 from sqlalchemy.orm import Session
 
 from app.database import Base
+from app.admin_security import verify_admin
 from app.main import _check_rate_limit, _is_trusted_proxy
-from app.models import SubmissionAttempt
+from app.models import AdminAuthAttempt, SubmissionAttempt
+
+
+def _admin_config() -> MagicMock:
+    config = MagicMock()
+    config.admin_token = "correct-token"
+    config.admin_auth_attempt_limit = 3
+    config.admin_auth_window_seconds = 600
+    config.rate_limit_secret = "test-secret-for-testing"
+    config.trusted_proxy_cidrs = ["127.0.0.1/32"]
+    return config
+
+
+def test_admin_auth_failures_are_hashed_and_limited() -> None:
+    engine = create_engine("sqlite://")
+    Base.metadata.create_all(engine)
+    request = MagicMock()
+    request.client.host = "203.0.113.42"
+    request.headers.get.return_value = None
+    with Session(engine) as db:
+        for _ in range(3):
+            with pytest.raises(HTTPException) as denied:
+                verify_admin(request, db, "Bearer wrong", _admin_config())
+            assert denied.value.status_code == 401
+        with pytest.raises(HTTPException) as limited:
+            verify_admin(request, db, "Bearer correct-token", _admin_config())
+        assert limited.value.status_code == 429
+        attempts = list(db.scalars(select(AdminAuthAttempt)))
+        assert len(attempts) == 3
+        assert all(item.client_hash != "203.0.113.42" and len(item.client_hash) == 64 for item in attempts)
+
+
+def test_successful_admin_auth_clears_previous_failures() -> None:
+    engine = create_engine("sqlite://")
+    Base.metadata.create_all(engine)
+    request = MagicMock()
+    request.client.host = "203.0.113.43"
+    request.headers.get.return_value = None
+    with Session(engine) as db:
+        with pytest.raises(HTTPException):
+            verify_admin(request, db, "Bearer wrong", _admin_config())
+        assert verify_admin(request, db, "Bearer correct-token", _admin_config()) == "admin"
+        assert list(db.scalars(select(AdminAuthAttempt))) == []
 
 
 def test_rate_limit_is_persistent_and_does_not_store_raw_client() -> None:

apps/api/tests/test_tackle_catalog.py

@@ -0,0 +1,32 @@
+from sqlalchemy import create_engine
+from sqlalchemy.orm import Session
+
+from app.database import Base
+from app.models import Rig, RigComponent, TackleItem
+from app.routers.catalog import rig_detail, tackle_item, tackle_items
+
+
+def test_tackle_catalog_filters_details_and_missing_fields() -> None:
+    engine = create_engine("sqlite://")
+    Base.metadata.create_all(engine)
+    with Session(engine) as db:
+        item = TackleItem(
+            name="API тестовая блесна", normalized_name="api тестовая блесна",
+            category="lure", subcategory="spinner", brand="RF4", family=None,
+            unlock_level=0, source_system="fixture", source_external_id="api-lure-1",
+            source_url="https://example.test/lure/api-lure-1",
+        )
+        rig = Rig(name="API тестовый монтаж", normalized_name="api тестовый монтаж", source_system="fixture")
+        rig.components.append(RigComponent(role="lure", position=0, tackle_item=item, raw_value=item.name))
+        db.add(rig)
+        db.commit()
+
+        page = tackle_items(db, category="lure", brand="RF4", family=None, unlock_level=None, limit=10, offset=0)
+        assert page.total == 1
+        assert page.items[0].missing_fields == ["family", "source_checked_at"]
+        assert tackle_item(item.id, db).name == item.name
+        details = rig_detail(rig.id, db)
+        assert details.components[0].raw_value == item.name
+        assert details.missing_fields == ["source_url", "source_checked_at"]
+
+    engine.dispose()

apps/api/tests/test_tackle_models.py

@@ -0,0 +1,35 @@
+import uuid
+
+from sqlalchemy import create_engine
+from sqlalchemy.orm import Session
+
+from app.database import Base
+from app.models import Rig, RigComponent, TackleItem
+
+
+def test_tackle_item_and_rig_components_keep_provenance_and_legacy_independence() -> None:
+    engine = create_engine("sqlite:///:memory:")
+    Base.metadata.create_all(engine)
+    item_id = uuid.uuid4()
+    rig_id = uuid.uuid4()
+    with Session(engine) as session:
+        item = TackleItem(
+            id=item_id, name="Spiker #2", normalized_name="spiker #2",
+            category="lure", subcategory="spinner", brand="RF4", family="spoon",
+            unlock_level=0, source_system="rf4db", source_external_id="spiker-2",
+            source_url="https://rf4db.com/ru/wiki/lures/spiker-2",
+            raw_payload={"weight": {"state": "value", "value": 0}},
+        )
+        rig = Rig(
+            id=rig_id, name="Method Popup", normalized_name="method popup",
+            source_system="rf4db", source_external_id="method-popup",
+        )
+        rig.components.append(RigComponent(role="lure", position=0, tackle_item=item, raw_value="Spiker #2"))
+        session.add(rig)
+        session.commit()
+
+        saved = session.get(TackleItem, item_id)
+        assert saved is not None
+        assert saved.unlock_level == 0
+        assert saved.raw_payload == {"weight": {"state": "value", "value": 0}}
+        assert saved.rig_components[0].rig_id == rig_id

apps/web/astro.config.mjs

@@ -7,4 +7,9 @@ export default defineConfig({
   output: "server",
   adapter: node({ mode: "standalone" }),
   server: { host: true, port: 4321 },
+  vite: {
+    // Keep executable scripts and compiled component styles in same-origin
+    // assets so production CSP does not need broad inline allowances.
+    build: { assetsInlineLimit: 0 },
+  },
 });

apps/web/public/site.webmanifest

@@ -6,8 +6,8 @@
   "start_url": "/",
   "scope": "/",
   "display": "standalone",
-  "background_color": "#f2f5ee",
-  "theme_color": "#082226",
+  "background_color": "#071719",
+  "theme_color": "#071719",
   "icons": [
     { "src": "/icon-192.png", "sizes": "192x192", "type": "image/png", "purpose": "any" },
     { "src": "/icon-512.png", "sizes": "512x512", "type": "image/png", "purpose": "any" },

apps/web/src/components/ActivityCard.astro

@@ -1,13 +1,14 @@
 ---
 import type { Activity } from "../lib/api";
-import { activityLevel, ago, kg, plural, spotPath } from "../lib/api";
+import { activityLevel, ago, kg, spotPath } from "../lib/api";
 import FishingIcon from "./FishingIcon.astro";
 import DataPassport from "./DataPassport.astro";
 import FishSilhouette from "./FishSilhouette.astro";
 import TackleGlyph from "./TackleGlyph.astro";
-const { item } = Astro.props as { item: Activity };
+const { item, periodLabel = null } = Astro.props as { item: Activity; periodLabel?: string | null };
 const level = activityLevel(item.activity_score);
 const limited = item.catches < 3;
+const precision = { exact: "точные", approximate: "приблизительные", area: "район", missing: "не указаны" }[item.coordinate_precision];
 ---
 <a class="spot-card" data-testid={`spot-${item.x}-${item.y}`} href={spotPath(item)}>
   <span class="spot-rank">{String(item.activity_score).padStart(2,"0")}</span>
@@ -15,10 +16,11 @@ const limited = item.catches < 3;
     <div class="spot-topline"><span>{item.waterbody}</span><span class="activity-pill" data-activity-level={level.short}><i></i>{level.short}</span>{limited && <span class="data-quality">Данных мало</span>}</div>
     <h3>{item.fish}</h3>
     <FishSilhouette name={item.fish}/>
-    <div class="spot-meta"><span><FishingIcon name="pin" size={14}/> {item.x}:{item.y}</span><span><FishingIcon name="clock" size={14}/> {ago(item.last_confirmed_at)}</span></div>
+    <div class="spot-meta"><span><FishingIcon name="pin" size={14}/> {item.x}:{item.y} · {precision}</span><span><FishingIcon name="clock" size={14}/> {ago(item.last_confirmed_at)}</span></div>
     <p class="data-note">{item.explanation}</p>
-    <DataPassport sources={item.sources} observedAt={item.last_confirmed_at} confidence={item.confidence_score}/>
-    <div class="bait-line"><TackleGlyph name={item.best_bait}/><div><span>Работает сейчас</span><strong>{item.best_bait ?? "не указана"}</strong></div></div>
+    <DataPassport sources={item.sources} observedAt={item.last_confirmed_at} periodLabel={periodLabel} confidence={item.confidence_score} sampleSize={item.catches} independentPlayers={item.unique_players} coordinatePrecision={item.coordinate_precision} status={limited ? "incomplete" : "verified"}/>
+    <div class="bait-line"><TackleGlyph name={item.best_bait}/><div><span>{limited ? "Нужно ещё подтверждений" : item.best_bait ? "Работает сейчас" : "Наживка не указана"}</span><strong>{item.best_bait ?? "не указана"}</strong></div></div>
+    <span class="card-cta">Открыть точку <span aria-hidden="true">→</span></span>
   </div>
-  <div class="spot-stats"><div><strong>{item.catches}</strong><span>{plural(item.catches, ["улов", "улова", "уловов"])}</span></div><div><strong>{item.unique_players}</strong><span>{plural(item.unique_players, ["игрок", "игрока", "игроков"])}</span></div><div><strong>{kg(item.average_weight_g)}</strong><span>средний вес</span></div><div><strong>{item.confidence_score}%</strong><span>уверенность</span></div></div><span class="card-arrow"><FishingIcon name="arrow" size={22}/></span>
+  <div class="spot-stats"><div><strong>{kg(item.average_weight_g)}</strong><span>средний вес</span></div><div><strong>{kg(item.max_weight_g)}</strong><span>макс. вес</span></div></div><span class="card-arrow"><FishingIcon name="arrow" size={22}/></span>
 </a>

apps/web/src/components/ActivityTimeline.astro

@@ -1,10 +1,11 @@
 ---
 const { buckets } = Astro.props as { buckets: { start: string; end: string; count: number }[] };
 const max = Math.max(1, ...buckets.map(bucket => bucket.count));
+const meterLevel = (count: number) => Math.round((count / max * 100) / 5) * 5;
 ---
 <section class="activity-timeline" aria-labelledby="timeline-title">
   <header><div><span class="overline">Последние 72 часа</span><h2 id="timeline-title">Леска активности</h2></div><p>Все одобренные записи · по времени поступления · шаг 12 часов</p></header>
   <div class="timeline-chart">
-    {buckets.map((bucket, index) => <div class="timeline-slot"><span aria-hidden="true" class="timeline-line" style={`--height:${bucket.count / max * 100}%`}>{bucket.count > 0 && <i></i>}</span><strong>{bucket.count}</strong><small>{`${(6-index)*12}–${(5-index)*12} ч назад`}</small></div>)}
+    {buckets.map((bucket, index) => <div class="timeline-slot"><span aria-hidden="true" class:list={["timeline-line", `meter-level-${meterLevel(bucket.count)}`]}>{bucket.count > 0 && <i></i>}</span><strong>{bucket.count}</strong><small>{`${(6-index)*12}–${(5-index)*12} ч назад`}</small></div>)}
   </div>
 </section>

apps/web/src/components/AdminNav.astro

@@ -0,0 +1,12 @@
+---
+const path = Astro.url.pathname;
+const links = [
+  ["/admin", "Обзор"],
+  ["/admin/moderation", "Уловы"],
+  ["/admin/external-sources", "Источники"],
+  ["/admin/media", "Медиа"],
+] as const;
+---
+<nav class="admin-nav" aria-label="Разделы админ-панели">
+  {links.map(([href, label]) => <a class={path === href ? "active" : undefined} aria-current={path === href ? "page" : undefined} href={href}>{label}</a>)}
+</nav>

apps/web/src/components/AtlasBreadcrumbs.astro

@@ -19,10 +19,10 @@ const { items } = Astro.props as { items: Item[] };
   ol::-webkit-scrollbar { display: none; }
   li { display: flex; align-items: center; flex: 0 0 auto; color: var(--text-muted); font-size: 12px; }
   a, li > span[aria-current] { padding: 8px 9px; color: inherit; text-decoration: none; white-space: nowrap; }
-  a:hover { color: var(--deep); text-decoration: underline; text-underline-offset: 4px; }
-  li > span[aria-current] { color: var(--deep); font-weight: 750; }
-  .atlas-breadcrumbs__knot { width: 7px; height: 7px; flex: 0 0 auto; border: 1px solid #78918a; border-radius: 50%; background: var(--paper); }
-  li:last-child .atlas-breadcrumbs__knot { border-color: #6f922d; background: var(--lime); box-shadow: 0 0 0 4px #c9f45b26; }
-  .atlas-breadcrumbs__line { width: clamp(18px, 3vw, 42px); height: 1px; background: repeating-linear-gradient(90deg,#9aaca5 0 5px,transparent 5px 8px); }
+  a:hover { color: var(--text-primary); text-decoration: underline; text-underline-offset: 4px; }
+  li > span[aria-current] { color: var(--text-primary); font-weight: 750; }
+  .atlas-breadcrumbs__knot { width: 7px; height: 7px; flex: 0 0 auto; border: 1px solid var(--border-strong); border-radius: 50%; background: var(--paper); }
+  li:last-child .atlas-breadcrumbs__knot { border-color: var(--accent-muted); background: var(--lime); box-shadow: 0 0 0 4px color-mix(in srgb,var(--lime) 18%,transparent); }
+  .atlas-breadcrumbs__line { width: clamp(18px, 3vw, 42px); height: 1px; background: repeating-linear-gradient(90deg,var(--border-strong) 0 5px,transparent 5px 8px); }
   @media (max-width: 720px) { .atlas-breadcrumbs { width: calc(100% - 28px); padding-top: 22px; } a, li > span[aria-current] { padding-inline: 7px; } }
 </style>

apps/web/src/components/AtlasEntityLink.astro

@@ -9,8 +9,8 @@ const { href, label, kind, identity } = Astro.props as { href: string; label: st
 </a>
 <style>
   .atlas-entity-link { display:grid;grid-template-columns:52px minmax(0,1fr) auto;align-items:center;gap:9px;min-height:54px;padding:5px 2px;border-bottom:1px solid var(--border-soft);color:var(--text-muted);font-size:13px;text-decoration:none }
-  .atlas-entity-link__mark { width:48px;height:38px;display:grid;place-items:center;color:#315f63 }
+  .atlas-entity-link__mark { width:48px;height:38px;display:grid;place-items:center;color:var(--decorative-water) }
   .atlas-entity-link__mark :global(.fish-silhouette),.atlas-entity-link__mark :global(.waterbody-mark) { position:static;opacity:.68 }
   .atlas-entity-link__mark :global(.waterbody-mark) { stroke:currentColor }.atlas-entity-link__mark :global(.waterbody-mark text) { fill:currentColor }
-  b { color:#6d8d2a;font-size:15px;transition:transform var(--motion-fast) var(--ease-out) }.atlas-entity-link:hover { color:var(--deep) }.atlas-entity-link:hover b { transform:translateX(2px) }
+  b { color:var(--accent-muted);font-size:15px;transition:transform var(--motion-fast) var(--ease-out) }.atlas-entity-link:hover { color:var(--text-primary) }.atlas-entity-link:hover b { transform:translateX(2px) }
 </style>

apps/web/src/components/CatchList.astro

@@ -14,5 +14,5 @@ const { catches } = Astro.props as { catches: Catch[] };
   })}
 </div>
 <style>
-  time{margin-top:7px;color:#496357;font-size:10px;font-weight:750}
+  time{margin-top:7px;color:var(--text-secondary);font-size:10px;font-weight:750}
 </style>

apps/web/src/components/DataPassport.astro

@@ -1,13 +1,17 @@
 ---
 import SourceBadge from "./SourceBadge.astro";
-import { ago } from "../lib/api";
-type Props = { sources: string[]; sourceUrl?: string | null; observedAt: string; completeness?: number | null; confidence?: number | null; status?: "verified" | "unverified" | "incomplete" };
-const { sources, sourceUrl, observedAt, completeness = null, confidence = null, status = "verified" } = Astro.props;
-const statusLabels = { verified: "Учтено", unverified: "Ждёт проверки", incomplete: "Неполные данные" };
+import { ago, freshnessStatus } from "../lib/api";
+type Props = { sources: string[]; sourceUrl?: string | null; observedAt?: string | null; periodLabel?: string | null; completeness?: number | null; confidence?: number | null; sampleSize?: number | null; independentPlayers?: number | null; coordinatePrecision?: "exact" | "approximate" | "area" | "missing" | null; status?: "verified" | "unverified" | "incomplete" };
+const { sources, sourceUrl, observedAt, periodLabel = null, completeness = null, confidence = null, sampleSize = null, independentPlayers = null, coordinatePrecision = null, status = "verified" } = Astro.props as Props;
+const freshness = freshnessStatus(observedAt);
+const displayStatus = status === "verified" && freshness === "stale" ? "stale" : status;
+const statusLabels = { verified: "Учтено", unverified: "Ждёт проверки", incomplete: "Неполные данные", stale: "Данные устарели" };
 const completenessLabel = completeness == null ? "Не рассчитана" : `${Math.min(100, Math.max(0, completeness))}% полей`;
+const precisionLabels = { exact: "точные", approximate: "приблизительные", area: "район", missing: "не указаны" };
 ---
 <section class="data-passport" aria-label="Паспорт данных">
-  <header><span>Паспорт данных</span><strong data-passport-status={status}>{statusLabels[status]}</strong></header>
+  <header><span>Паспорт данных</span><strong data-passport-status={displayStatus}>{statusLabels[displayStatus]}</strong></header>
   <div class="data-passport__sources">{sources.map(source => <SourceBadge source={source} href={sources.length === 1 ? sourceUrl : null}/>)}</div>
-  <dl><div><dt>Свежесть</dt><dd>{ago(observedAt)}</dd></div><div><dt>Полнота</dt><dd>{completenessLabel}</dd></div><div><dt>Доверие</dt><dd>{confidence == null ? "После проверки" : `${confidence}%`}</dd></div></dl>
+  <dl><div><dt>Свежесть</dt><dd data-freshness={freshness}>{freshness === "stale" ? "Устарело" : freshness === "fresh" ? "Свежо" : "Не указана"}{observedAt && ` · ${ago(observedAt)}`}</dd></div>{periodLabel && <div><dt>Период</dt><dd>{periodLabel}</dd></div>}<div><dt>Полнота</dt><dd>{completenessLabel}</dd></div><div><dt>Доверие</dt><dd>{confidence == null ? "После проверки" : `${confidence}%`}</dd></div>{sampleSize != null && <div><dt>Наблюдения</dt><dd>{sampleSize}</dd></div>}{independentPlayers != null && <div><dt>Игроки</dt><dd>{independentPlayers}</dd></div>}{coordinatePrecision && <div><dt>Координаты</dt><dd>{precisionLabels[coordinatePrecision]}</dd></div>}</dl>
+  {sampleSize != null && sampleSize < 3 && <p class="data-passport__minimum">Минимум для рекомендации: 3 наблюдения.</p>}
 </section>

apps/web/src/components/EntityMedia.astro

@@ -0,0 +1,15 @@
+---
+import SourceBadge from "./SourceBadge.astro";
+import type { MediaAsset } from "../lib/api";
+const { asset, compact = false, sourceLink = false } = Astro.props as { asset: MediaAsset; compact?: boolean; sourceLink?: boolean };
+---
+<figure class:list={["entity-media", { "entity-media--compact": compact }]}>
+  <span class="entity-media__frame"><picture>
+    {(["avif", "webp"] as const).map(format => {
+      const variants = (asset.variants ?? []).filter(item => item.format === format);
+      return variants.length ? <source type={`image/${format}`} srcset={variants.map(item => `${item.url} ${item.width}w`).join(", ")} sizes={compact ? "180px" : "(max-width: 720px) 100vw, 720px"} /> : null;
+    })}
+    <img src={asset.image_url} alt={asset.label ?? "Иллюстрация RF4"} width={asset.width} height={asset.height} loading="lazy" decoding="async" />
+  </picture></span>
+  <figcaption><SourceBadge source={asset.source_system} href={sourceLink ? asset.source_url : undefined} /><span>{asset.label ?? "Справочный материал"}</span></figcaption>
+</figure>

apps/web/src/components/Pagination.astro

@@ -0,0 +1,27 @@
+---
+import { pageHref, pageWindow } from "../lib/pagination";
+
+interface Props {
+  path: string;
+  params: URLSearchParams;
+  total: number;
+  limit: number;
+  offset: number;
+  anchor?: string;
+  itemLabel?: string;
+}
+
+const { path, params, total, limit, offset, anchor = "", itemLabel = "записей" } = Astro.props;
+const state = pageWindow(total, limit, offset);
+---
+{total > limit && <nav class="pagination" aria-label="Пагинация">
+  <span>{state.start}–{state.end} из {total} {itemLabel} · страница {state.page} из {state.pages}</span>
+  <div>
+    {state.previousOffset !== null
+      ? <a data-action="secondary" rel="prev" href={pageHref(path, params, state.previousOffset, anchor)}>← Предыдущая</a>
+      : <span class="pagination__disabled" aria-disabled="true">← Предыдущая</span>}
+    {state.nextOffset !== null
+      ? <a data-action="secondary" rel="next" href={pageHref(path, params, state.nextOffset, anchor)}>Следующая →</a>
+      : <span class="pagination__disabled" aria-disabled="true">Следующая →</span>}
+  </div>
+</nav>}

apps/web/src/components/SignalFeed.astro

@@ -31,6 +31,6 @@ const groups = [...signals.reduce((map, signal) => {
   })}</div>
 </section>
 <style>
-  .repeat-note{position:relative;z-index:1;margin:-8px 0 10px!important;padding:6px 9px;border-left:2px solid #6b8d74;color:#496357!important;font-size:10px!important}
+  .repeat-note{position:relative;z-index:1;margin:-8px 0 10px!important;padding:6px 9px;border-left:2px solid var(--border-strong);color:var(--text-secondary)!important;font-size:10px!important}
   .signal-card__top .source-strip{margin:0}
 </style>

apps/web/src/layouts/Layout.astro

@@ -11,8 +11,13 @@ import "../styles/tackle-glyph.css";
 import "../styles/empty-states.css";
 import "../styles/alpha-banner.css";
 import "../styles/signal-pagination.css";
+import "../styles/pagination.css";
 import "../styles/dashboard-polish.css";
 import "../styles/loading-states.css";
+import "../styles/query-context.css";
+import "../styles/plan.css";
+import "../styles/theme.css";
+import "../styles/media-catalog.css";
 import FishingIcon from "../components/FishingIcon.astro";
 import AlphaBanner from "../components/AlphaBanner.astro";
 const {
@@ -24,10 +29,17 @@ const {
   errorPage = false,
 } = Astro.props;
 const path = Astro.url.pathname;
+const storedTheme = Astro.cookies.get("rf4-theme")?.value;
+const theme = storedTheme === "light" || storedTheme === "dark" ? storedTheme : "system";
 const siteUrl = import.meta.env.PUBLIC_SITE_URL || "https://rf4spotter.ru";
 const canonical = new URL(path, siteUrl).toString();
 const socialImage = new URL(image, siteUrl).toString();
-const preventIndexing = noindex || path.startsWith("/admin/");
+const isAdminPath = path === "/admin" || path.startsWith("/admin/");
+const preventIndexing = noindex || isAdminPath;
+if (isAdminPath) {
+  Astro.response.headers.set("Cache-Control", "private, no-store");
+  Astro.response.headers.set("X-Robots-Tag", "noindex, nofollow");
+}
 const websiteJsonLd = { "@type": "WebSite", name: "RF4 Spotter", url: siteUrl, inLanguage: "ru" };
 // A08: Skip structuredData on error pages (explicit errorPage prop)
 // Don't infer error from noindex alone — main page can have noindex on 422
@@ -36,9 +48,46 @@ const jsonLd = JSON.stringify({
   "@context": "https://schema.org",
   "@graph": jsonLdGraph,
 }).replaceAll("<", "\\u003c");
+const configuredFilesDomain = process.env.FILES_DOMAIN || "files.rf4spotter.ru";
+const filesDomain = /^(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$/i.test(configuredFilesDomain)
+  ? configuredFilesDomain
+  : "files.rf4spotter.ru";
+const isLoopback = (hostname: string) => hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+const safeOrigin = (value: string | undefined, fallback: string) => {
+  try {
+    const url = new URL(value || fallback);
+    return url.protocol === "https:" || (url.protocol === "http:" && isLoopback(url.hostname)) ? url.origin : fallback;
+  } catch {
+    return fallback;
+  }
+};
+const apiOrigin = safeOrigin(import.meta.env.PUBLIC_API_URL, siteUrl);
+const filesFallback = `https://${filesDomain}`;
+const filesOrigin = (() => {
+  try {
+    const url = new URL(process.env.FILES_ORIGIN || filesFallback);
+    if ((url.protocol === "https:" && url.hostname === filesDomain) || (url.protocol === "http:" && isLoopback(url.hostname))) {
+      return url.origin;
+    }
+  } catch {
+    // Invalid deployment input falls back to the validated production hostname.
+  }
+  return filesFallback;
+})();
+const localOrigins = [apiOrigin, filesOrigin].filter((origin) => origin.startsWith("http://"));
+const cspNonce = crypto.randomUUID().replaceAll("-", "");
+Astro.response.headers.set("Content-Security-Policy", [
+  "default-src 'self'", "base-uri 'self'", "object-src 'none'", "frame-ancestors 'none'",
+  "form-action 'self'", `connect-src 'self'${apiOrigin === siteUrl ? "" : ` ${apiOrigin}`}`,
+  `img-src 'self' data: ${filesOrigin}`,
+  "font-src 'self'", "media-src 'self'", "manifest-src 'self'",
+  `script-src 'self' 'nonce-${cspNonce}'`, "script-src-attr 'none'",
+  "style-src 'self'", "style-src-attr 'none'",
+  ...(localOrigins.length ? [] : ["upgrade-insecure-requests"]),
+].join("; "));
 ---
 <!doctype html>
-<html lang="ru">
+<html lang="ru" data-theme={theme === "system" ? undefined : theme}>
   <head>
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width" />
@@ -49,7 +98,8 @@ const jsonLd = JSON.stringify({
     <link rel="icon" href="/favicon-32.png" sizes="32x32" type="image/png" />
     <link rel="apple-touch-icon" href="/apple-touch-icon.png" />
     <link rel="manifest" href="/site.webmanifest" />
-    <meta name="theme-color" content="#082226" />
+    <meta name="theme-color" content="#f2f5ee" media={theme === "system" ? "(prefers-color-scheme: light)" : theme === "light" ? "all" : "not all"} data-theme-color="light" />
+    <meta name="theme-color" content="#071719" media={theme === "system" ? "(prefers-color-scheme: dark)" : theme === "dark" ? "all" : "not all"} data-theme-color="dark" />
     <meta property="og:locale" content="ru_RU" />
     <meta property="og:type" content="website" />
     <meta property="og:site_name" content="RF4 Spotter" />
@@ -66,18 +116,50 @@ const jsonLd = JSON.stringify({
     <meta name="twitter:description" content={description} />
     <meta name="twitter:image" content={socialImage} />
     <meta name="twitter:image:alt" content="Лаймовый поплавок на тёмном озере с координатной сеткой" />
-    <script type="application/ld+json" set:html={jsonLd} is:inline />
+    <script type="application/ld+json" nonce={cspNonce} set:html={jsonLd} is:inline />
     <title>{title}</title>
   </head>
   <body>
     <a class="skip-link" href="#main-content">Перейти к содержимому</a>
     <header class="topbar">
       <a href="/" class="brand"><span class="brand-mark" aria-hidden="true"><FishingIcon name="hook" size={24}/></span><span class="brand-name"><strong>RF4 Spotter</strong><span>Ни хвоста, ни чешуи</span></span></a>
-      <nav aria-label="Разделы сайта"><a class:list={{active:path === "/"}} aria-current={path === "/" ? "page" : undefined} href="/"><FishingIcon name="float"/> <span>Сейчас клюёт</span></a><a class:list={{active:path.startsWith("/waterbodies") || path.startsWith("/fish")}} aria-current={path.startsWith("/waterbodies") || path.startsWith("/fish") ? "page" : undefined} href="/waterbodies"><FishingIcon name="ripple"/> <span>Каталог</span></a><a class:list={{active:path.startsWith("/records")}} aria-current={path.startsWith("/records") ? "page" : undefined} href="/records"><FishingIcon name="trophy"/> <span>Рекорды</span></a><a class:list={{active:path.startsWith("/report")}} aria-current={path.startsWith("/report") ? "page" : undefined} href="/report"><FishingIcon name="plus"/> <span>Добавить улов</span></a></nav>
+      <nav aria-label="Разделы сайта"><a class:list={{active:path === "/"}} aria-current={path === "/" ? "page" : undefined} href="/"><FishingIcon name="float"/> <span>Сейчас клюёт</span></a><a class:list={{active:path.startsWith("/waterbodies") || path.startsWith("/fish")}} aria-current={path.startsWith("/waterbodies") || path.startsWith("/fish") ? "page" : undefined} href="/waterbodies"><FishingIcon name="ripple"/> <span>Каталог</span></a><a class:list={{active:path === "/plan"}} aria-current={path === "/plan" ? "page" : undefined} href="/plan"><FishingIcon name="pin"/> <span>Мой план</span></a><a class:list={{active:path.startsWith("/media") || path.startsWith("/admin/media")}} aria-current={path.startsWith("/media") || path.startsWith("/admin/media") ? "page" : undefined} href="/media"><FishingIcon name="lure"/> <span>Медиатека</span></a><a class:list={{active:path.startsWith("/records")}} aria-current={path.startsWith("/records") ? "page" : undefined} href="/records"><FishingIcon name="trophy"/> <span>Рекорды</span></a><a class:list={{active:path.startsWith("/report")}} aria-current={path.startsWith("/report") ? "page" : undefined} href="/report"><FishingIcon name="plus"/> <span>Добавить улов</span></a></nav>
+      <div class="header-tools">
         <p class="live-badge"><span></span> Свежие данные и честная оценка</p>
+        <div class="theme-switcher" role="group" aria-label="Цветовая тема">
+          <button type="button" data-theme-option="system" aria-pressed={theme === "system"} title="Использовать системную тему"><span aria-hidden="true">◐</span><b>Системная</b></button>
+          <button type="button" data-theme-option="light" aria-pressed={theme === "light"} title="Включить светлую тему"><span aria-hidden="true">☀</span><b>Светлая</b></button>
+          <button type="button" data-theme-option="dark" aria-pressed={theme === "dark"} title="Включить тёмную тему"><span aria-hidden="true">●</span><b>Тёмная</b></button>
+        </div>
+      </div>
     </header>
     <AlphaBanner />
     <main id="main-content" tabindex="-1"><slot /></main>
     <footer><a href="/" class="brand"><span class="brand-mark" aria-hidden="true"><FishingIcon name="hook" size={24}/></span><span class="brand-name"><strong>RF4 Spotter</strong><span>Ни хвоста, ни чешуи</span></span></a><p>Неофициальный проект для игроков Russian Fishing 4. <a href="/status">Статус</a> · <a href="/rules">Правила</a> · <a href="/privacy">Конфиденциальность</a></p><span>RF4S · 2026</span></footer>
   </body>
 </html>
+<script>
+  const root = document.documentElement;
+  const themeButtons = document.querySelectorAll<HTMLButtonElement>("[data-theme-option]");
+  const themeColors = document.querySelectorAll<HTMLMetaElement>("[data-theme-color]");
+  const allowedThemes = new Set(["system", "light", "dark"]);
+
+  const applyTheme = (value: string) => {
+    const theme = allowedThemes.has(value) ? value : "system";
+    if (theme === "system") delete root.dataset.theme;
+    else root.dataset.theme = theme;
+    themeButtons.forEach((button) => {
+      button.setAttribute("aria-pressed", String(button.dataset.themeOption === theme));
+    });
+    themeColors.forEach((meta) => {
+      const color = meta.dataset.themeColor;
+      meta.media = theme === "system" ? `(prefers-color-scheme: ${color})` : color === theme ? "all" : "not all";
+    });
+    const secure = location.protocol === "https:" ? "; Secure" : "";
+    document.cookie = `rf4-theme=${theme}; Max-Age=31536000; Path=/; SameSite=Lax${secure}`;
+  };
+
+  themeButtons.forEach((button) => {
+    button.addEventListener("click", () => applyTheme(button.dataset.themeOption ?? "system"));
+  });
+</script>

apps/web/src/lib/admin-errors.ts

@@ -0,0 +1,11 @@
+export function adminErrorMessage(status: number, fallback: string): string {
+  if (status === 401) return "Неверный или истёкший административный токен.";
+  if (status === 409) return "Операция конфликтует с изменением в другой вкладке.";
+  if (status === 429) return "Слишком много попыток. Повторите позже.";
+  if (status >= 500) return "Сервис временно недоступен. Проверьте состояние и повторите позже.";
+  return fallback;
+}
+
+export function adminEndsSession(status: number): boolean {
+  return status === 401 || status === 429;
+}

apps/web/src/lib/api.ts

@@ -4,6 +4,7 @@ export type Activity = {
   unique_players: number; average_weight_g: number; max_weight_g: number;
   last_confirmed_at: string; activity_score: number; confidence_score: number;
   explanation: string; sources: string[];
+  coordinate_precision: "exact" | "approximate" | "area" | "missing"; coordinate_sources: string[];
 };
 
 export type PaginatedActivity = {
@@ -13,9 +14,11 @@ export type PaginatedActivity = {
   offset: number;
 };
 
-export type Spot = { id: string; waterbody_slug: string; waterbody: string; x: number; y: number; description: string | null; catches_24h: number; catches_3d: number; catches_7d: number; top_baits: string[] };
+export type Spot = { id: string; waterbody_slug: string; waterbody: string; x: number; y: number; description: string | null; catches_24h: number; catches_3d: number; catches_7d: number; top_baits: string[]; coordinate_precision: "exact" | "approximate" | "area" | "missing"; coordinate_sources: string[] };
 export type Catch = { id: string; fish: string; weight_g: number; bait: string | null; player_name: string | null; caught_at: string | null; reported_at: string; retrieve_method: string | null; retrieve_speed: number | null; source_system: string; source_url: string | null };
-export type DictionaryItem = { id: string; slug: string; name_ru: string };
+export type DictionaryItem = { id: string; slug: string; name_ru: string; unlock_level?: number | null; fish_species_count?: number | null; source_system?: string | null; source_external_id?: string | null; source_url?: string | null; description?: string | null; source_aliases?: string[] | null; source_fish_species?: string[] | null; source_image_urls?: string[] | null; source_point_urls?: string[] | null; source_checked_at?: string | null };
+export type TackleItem = { id: string; name: string; category: string; subcategory: string | null; brand: string | null; family: string | null; unlock_level: number | null; source_system: string | null; source_external_id: string | null; source_url: string | null; source_checked_at: string | null; missing_fields: string[] };
+export type PaginatedTackleItems = { items: TackleItem[]; total: number; limit: number; offset: number };
 export type OfficialRecord = { id: string; fish: string; weight_g: number; waterbody: string; bait: string | null; player_name: string | null; record_date: string | null; category: string | null; region: string | null; source_url: string | null; source_system: string };
 export type PaginatedOfficialRecord = {
   items: OfficialRecord[];
@@ -26,10 +29,12 @@ export type PaginatedOfficialRecord = {
 export type PublicObservation = { id: string; source_system: string; source_name: string; source_url: string; fish_name: string; waterbody_name: string; x: number | null; y: number | null; weight_g: number | null; last_seen_at: string; missing_fields: string[]; quality: "incomplete" | "unverified" };
 export type ImportRun = { id: string; started_at: string; finished_at: string | null; status: string; source_url: string; rows_seen: number; rows_created: number; rows_updated: number; error_summary: string | null };
 export type SourceStatus = { source_system: string; name: string; status: "healthy" | "stale" | "temporarily_limited" | "source_changed" | "waiting" | "disabled"; last_started_at: string | null; last_success_at: string | null; observations: number };
+export type MediaVariant = { role: "card" | "detail"; format: "webp" | "avif"; width: number; height: number; url: string };
+export type MediaAsset = { id: string; entity_type: "fish" | "waterbody" | "tackle" | "reference"; entity_key: string; label: string | null; width: number; height: number; content_type: string; image_url: string; source_system: string; source_url: string; variants?: MediaVariant[] };
 
 export const spotPath = (item: Pick<Activity, "waterbody_slug" | "x" | "y">) => `/spots/${item.waterbody_slug}-${item.x}x${item.y}`;
 
-export { activityLevel, ago, kg, plural } from "./presentation";
+export { activityLevel, ago, freshnessStatus, kg, plural } from "./presentation";
 
 const base = process.env.API_INTERNAL_URL || import.meta.env.API_INTERNAL_URL || "http://localhost:8000";
 

apps/web/src/lib/media.ts

@@ -0,0 +1,23 @@
+import type { MediaAsset } from "./api";
+
+const tokens = (value: string) => value
+  .toLocaleLowerCase("ru")
+  .replaceAll("ё", "е")
+  .replace(/^(оз\.|р\.)\s*/, "")
+  .replace(/[^a-zа-я0-9]+/giu, " ")
+  .trim()
+  .split(/\s+/)
+  .filter(Boolean);
+
+export const findMediaByLabel = (assets: MediaAsset[], label: string): MediaAsset | undefined => {
+  const wanted = tokens(label);
+  const exact = assets.filter((asset) => tokens(asset.label ?? "").join(" ") === wanted.join(" "));
+  if (exact.length === 1) return exact[0];
+
+  const wantedSet = new Set(wanted);
+  const candidates = assets.filter((asset) => {
+    const available = new Set(tokens(asset.label ?? ""));
+    return wanted.every((token) => available.has(token)) || [...available].every((token) => wantedSet.has(token));
+  });
+  return candidates.length === 1 ? candidates[0] : undefined;
+};

apps/web/src/lib/pagination.ts

@@ -0,0 +1,31 @@
+export type PageWindow = {
+  start: number;
+  end: number;
+  page: number;
+  pages: number;
+  previousOffset: number | null;
+  nextOffset: number | null;
+};
+
+export const pageWindow = (total: number, limit: number, offset: number): PageWindow => {
+  const safeTotal = Math.max(0, Math.trunc(total));
+  const safeLimit = Math.max(1, Math.trunc(limit));
+  const safeOffset = Math.max(0, Math.trunc(offset));
+  const end = Math.min(safeOffset + safeLimit, safeTotal);
+  return {
+    start: safeTotal > 0 && safeOffset < safeTotal ? safeOffset + 1 : 0,
+    end,
+    page: Math.floor(safeOffset / safeLimit) + 1,
+    pages: Math.max(1, Math.ceil(safeTotal / safeLimit)),
+    previousOffset: safeOffset > 0 ? Math.max(0, safeOffset - safeLimit) : null,
+    nextOffset: end < safeTotal ? safeOffset + safeLimit : null,
+  };
+};
+
+export const pageHref = (path: string, search: URLSearchParams, offset: number, anchor = "") => {
+  const params = new URLSearchParams(search);
+  if (offset > 0) params.set("offset", String(offset));
+  else params.delete("offset");
+  const query = params.toString();
+  return `${path}${query ? `?${query}` : ""}${anchor}`;
+};

apps/web/src/lib/presentation.ts

@@ -20,3 +20,10 @@ export function ago(value: string) {
   const minutes = Math.max(0, Math.round((Date.now() - new Date(value).getTime()) / 60000));
   return minutes < 60 ? `${minutes} мин назад` : `${Math.floor(minutes / 60)} ч назад`;
 }
+
+export function freshnessStatus(value: string | null | undefined, now = Date.now()): "fresh" | "stale" | "unknown" {
+  if (!value) return "unknown";
+  const timestamp = new Date(value).getTime();
+  if (!Number.isFinite(timestamp)) return "unknown";
+  return now - timestamp > 48 * 60 * 60 * 1000 ? "stale" : "fresh";
+}

apps/web/src/pages/admin/external-sources.astro

@@ -1,41 +1,64 @@
 ---
 import Layout from "../../layouts/Layout.astro";
+import AdminNav from "../../components/AdminNav.astro";
 const apiUrl = import.meta.env.PUBLIC_API_URL || "http://localhost:8000";
 ---
 <Layout title="Внешние источники — RF4 Spotter">
   <section class="form-hero"><div><span class="eyebrow"><b>ADMIN</b> Staging</span><h1>Внешние<br/><em>наблюдения</em></h1></div><p>Сопоставьте названия с каноническим каталогом. Опубликовать можно только запись с координатами и весом.</p></section>
   <section class="moderation-app" data-api-url={apiUrl}>
+    <AdminNav />
     <form class="admin-login" autocomplete="off"><label>Административный токен<input name="token" type="password" required autocomplete="off" /></label><button data-action="primary" type="submit">Открыть очередь</button></form>
     <p class="privacy">Токен остаётся только в памяти страницы. Исходная ссылка и происхождение сохраняются при публикации.</p>
-    <div class="notice error" data-admin-error role="alert" hidden></div><div class="moderation-list" data-external-list aria-live="polite"></div>
+    <div class="admin-session-bar" hidden><span>Административная сессия активна</span><button data-action="secondary" type="button" data-admin-logout>Выйти</button></div>
+    <form class="admin-queue-filters" hidden>
+      <label>Поиск<input name="q" type="search" maxlength="100" placeholder="Рыба или водоём" /></label>
+      <label>Источник<select name="source"><option value="">Все источники</option></select></label>
+      <label>Полнота<select name="completeness"><option value="all">Все записи</option><option value="complete">Только полные</option><option value="incomplete">Только неполные</option></select></label>
+      <label>Порядок<select name="order"><option value="risk">Сначала требуют внимания</option><option value="newest">Сначала новые</option><option value="oldest">Сначала старые</option></select></label>
+      <button data-action="primary" type="submit">Применить</button>
+    </form>
+    <div class="notice error" data-admin-error role="alert" hidden></div><div class="notice success" data-admin-status role="status" hidden></div><div class="moderation-list" data-external-list aria-live="polite"></div>
     <nav data-pages aria-label="Страницы очереди" hidden>
       <button data-action="secondary" type="button" data-previous>Предыдущая</button>
       <span data-page-number aria-live="polite"></span>
-      <button data-action="secondary" type="button" data-next>Следующая</button>
+      <button data-action="secondary" type="button" data-next>Следующая</button><button data-action="secondary" type="button" data-refresh>Обновить</button>
     </nav>
+    <p class="admin-shortcuts"><kbd>S</kbd> подсказать · <kbd>M</kbd> сопоставить · <kbd>P</kbd> опубликовать карточку с фокусом</p>
   </section>
   <script>
+    import { adminEndsSession, adminErrorMessage } from "../../lib/admin-errors";
     const root = document.querySelector<HTMLElement>(".moderation-app");
     const login = document.querySelector<HTMLFormElement>(".admin-login");
     const list = document.querySelector<HTMLElement>("[data-external-list]");
     const error = document.querySelector<HTMLElement>("[data-admin-error]");
+    const status = document.querySelector<HTMLElement>("[data-admin-status]");
     const pages = document.querySelector<HTMLElement>("[data-pages]");
     const previous = document.querySelector<HTMLButtonElement>("[data-previous]");
     const next = document.querySelector<HTMLButtonElement>("[data-next]");
+    const refresh = document.querySelector<HTMLButtonElement>("[data-refresh]");
     const pageNumber = document.querySelector<HTMLElement>("[data-page-number]");
+    const sessionBar = document.querySelector<HTMLElement>(".admin-session-bar");
+    const logout = document.querySelector<HTMLButtonElement>("[data-admin-logout]");
+    const filters = document.querySelector<HTMLFormElement>(".admin-queue-filters");
     let offset = 0;
     let token = ""; let fishes: Record<string, string>[] = []; let waters: Record<string, string>[] = [];
+    let sessionTimer: ReturnType<typeof setTimeout> | undefined;
     const loadingCards = () => `<div class="loading-grid" aria-hidden="true">${Array.from({length:2}, () => '<div class="loading-card"><span class="loading-line loading-line--label"></span><span class="loading-line loading-line--title"></span><span class="loading-line"></span><span class="loading-line loading-line--short"></span></div>').join("")}</div><span class="sr-only">Загружаем внешние наблюдения</span>`;
     const setLoading = (loading: boolean) => list?.setAttribute("aria-busy", String(loading));
     const esc = (value: unknown) => String(value ?? "—").replace(/[&<>'"]/g, char => ({"&":"&amp;","<":"&lt;",">":"&gt;","'":"&#39;",'"':"&quot;"}[char] ?? char));
-    const fail = (message: string) => { if (error) { error.textContent = message; error.hidden = false; } };
+    const safeHttpUrl = (value: unknown) => { try { const url = new URL(String(value)); return url.protocol === "http:" || url.protocol === "https:" ? esc(url.href) : ""; } catch { return ""; } };
+    const fail = (message: string) => { if (status) status.hidden = true; if (error) { error.textContent = message; error.hidden = false; } };
+    const succeed = (message: string) => { if (error) error.hidden = true; if (status) { status.textContent = message; status.hidden = false; } };
+    const endSession = (message?: string) => { token = ""; if (sessionTimer) clearTimeout(sessionTimer); sessionTimer = undefined; if (login) { login.hidden = false; login.reset(); } if (sessionBar) sessionBar.hidden = true; if (filters) filters.hidden = true; if (list) list.innerHTML = ""; pages?.setAttribute("hidden", ""); if (message) fail(message); };
+    const keepSession = () => { if (sessionTimer) clearTimeout(sessionTimer); sessionTimer = setTimeout(() => endSession("Сессия завершена после 15 минут бездействия. Введите токен снова."), 15 * 60 * 1000); };
     const options = (items: Record<string, string>[], selected?: unknown) => items.map(item => `<option value="${esc(item.slug)}" ${item.slug === selected ? "selected" : ""}>${esc(item.name_ru)}</option>`).join("");
-    async function json(url: string, init: RequestInit = {}) { const response = await fetch(url, init); if (!response.ok) throw new Error(response.status === 401 ? "Неверный административный токен." : `Запрос завершился ошибкой ${response.status}.`); return response.json(); }
+    async function json(url: string, init: RequestInit = {}) { const response = await fetch(url, init); if (response.status === 409) { await loadQueue(); throw new Error("Запись уже изменена в другой вкладке. Очередь обновлена."); } if (!response.ok) { if (adminEndsSession(response.status)) endSession(); throw new Error(adminErrorMessage(response.status, `Запрос завершился ошибкой ${response.status}.`)); } if ((init.headers as Record<string, string> | undefined)?.Authorization) keepSession(); return response.json(); }
     async function loadQueue() {
       if (!root || !list) return; error?.setAttribute("hidden", ""); setLoading(true); list.innerHTML = loadingCards();
-      [fishes, waters] = await Promise.all([json(`${root.dataset.apiUrl}/api/v1/fishes`), json(`${root.dataset.apiUrl}/api/v1/waterbodies`)]);
+      if (!fishes.length || !waters.length) { const [fishRows, waterRows, sources] = await Promise.all([json(`${root.dataset.apiUrl}/api/v1/fishes`), json(`${root.dataset.apiUrl}/api/v1/waterbodies`), json(`${root.dataset.apiUrl}/api/v1/source-status`)]); fishes = fishRows; waters = waterRows; const sourceSelect = filters?.querySelector<HTMLSelectElement>('[name="source"]'); if (sourceSelect) sourceSelect.innerHTML = '<option value="">Все источники</option>' + (sources as Record<string, unknown>[]).map(source => `<option value="${esc(source.source_system)}">${esc(source.name)}</option>`).join(""); }
       pages?.setAttribute("hidden", "");
-      const rows = await json(`${root.dataset.apiUrl}/api/v1/admin/external-observations?status=review&limit=51&offset=${offset}`, {headers:{Authorization:`Bearer ${token}`}});
+      const values = new FormData(filters ?? undefined); const params = new URLSearchParams({status:"review",limit:"51",offset:String(offset),completeness:String(values.get("completeness") || "all"),order:String(values.get("order") || "newest")}); const source = String(values.get("source") || ""); const query = String(values.get("q") || "").trim(); if (source) params.set("source_system", source); if (query) params.set("q", query);
+      const rows = await json(`${root.dataset.apiUrl}/api/v1/admin/external-observations?${params}`, {headers:{Authorization:`Bearer ${token}`}});
       setLoading(false);
       if (!rows.length && offset > 0) { offset = 0; return loadQueue(); }
       const pending = rows.slice(0, 50);
@@ -44,7 +67,21 @@ const apiUrl = import.meta.env.PUBLIC_API_URL || "http://localhost:8000";
       if (next) next.disabled = rows.length <= 50;
       if (pageNumber) pageNumber.textContent = `Страница ${offset / 50 + 1}`;
       if (!pending.length) { list.innerHTML = '<div class="state"><h2>Очередь пуста</h2><p>Все внешние записи обработаны.</p></div>'; return; }
-      list.innerHTML = pending.map((row: Record<string, unknown>) => { const complete = row.x != null && row.y != null && row.weight_g != null; return `<article class="moderation-card" data-observation-id="${esc(row.id)}"><div class="moderation-summary"><span class="activity-pill"><i></i>${esc(row.source_system)} · ${esc(row.status)}</span><h2>${esc(row.fish_name)}</h2><p>${esc(row.waterbody_name)}</p><dl><div><dt>Координаты</dt><dd>${row.x == null || row.y == null ? "нет" : `${esc(row.x)}:${esc(row.y)}`}</dd></div><div><dt>Вес</dt><dd>${row.weight_g == null ? "нет" : `${esc(row.weight_g)} г`}</dd></div><div><dt>ID источника</dt><dd>${esc(row.source_external_id)}</dd></div><div><dt>Состояние</dt><dd>${complete ? "полная запись" : "неполная"}</dd></div></dl><a href="${esc(row.source_url)}" target="_blank" rel="noreferrer">Открыть первоисточник</a></div><div class="moderation-actions"><label>Каноническая рыба<select name="fish" required><option value="">Выберите…</option>${options(fishes, row.fish_slug)}</select></label><label>Канонический водоём<select name="waterbody" required><option value="">Выберите…</option>${options(waters, row.waterbody_slug)}</select></label><label>Примечание<textarea name="note" rows="2" maxlength="1000">${esc(row.review_note ?? "")}</textarea></label><p data-alias-message role="status"></p><div><button data-action="secondary" type="button" data-suggest>Подсказать соответствия</button><button data-action="secondary" type="button" data-map>Сопоставить</button><button data-action="primary" type="button" data-publish ${complete && row.status === "ready" ? "" : "disabled"}>Опубликовать</button><button data-action="danger" type="button" data-reject>Отклонить</button></div></div></article>`; }).join("");
+      list.innerHTML = pending.map((row: Record<string, unknown>) => { const complete = row.x != null && row.y != null && row.weight_g != null; const sourceUrl = safeHttpUrl(row.source_url); return `<article class="moderation-card" data-observation-id="${esc(row.id)}" data-version="${esc(row.moderation_version)}"><div class="moderation-summary"><span class="activity-pill"><i></i>${esc(row.source_system)} · ${esc(row.status)}</span><h2>${esc(row.fish_name)}</h2><p>${esc(row.waterbody_name)}</p><dl><div><dt>Координаты</dt><dd>${row.x == null || row.y == null ? "нет" : `${esc(row.x)}:${esc(row.y)}`}</dd></div><div><dt>Вес</dt><dd>${row.weight_g == null ? "нет" : `${esc(row.weight_g)} г`}</dd></div><div><dt>ID источника</dt><dd>${esc(row.source_external_id)}</dd></div><div><dt>Состояние</dt><dd>${complete ? "полная запись" : "неполная"}</dd></div></dl>${sourceUrl ? `<a href="${sourceUrl}" target="_blank" rel="noreferrer">Открыть первоисточник</a>` : '<span class="privacy">Ссылка источника имеет небезопасный формат</span>'}</div><div class="moderation-actions"><label>Каноническая рыба<select name="fish" required><option value="">Выберите…</option>${options(fishes, row.fish_slug)}</select></label><label>Канонический водоём<select name="waterbody" required><option value="">Выберите…</option>${options(waters, row.waterbody_slug)}</select></label><label>Примечание<textarea name="note" rows="2" maxlength="1000">${esc(row.review_note ?? "")}</textarea></label><p data-alias-message role="status"></p><div><button data-action="secondary" type="button" data-suggest>Подсказать соответствия</button><button data-action="secondary" type="button" data-map>Сопоставить</button><button data-action="primary" type="button" data-publish ${complete && row.status === "ready" ? "" : "disabled"}>Опубликовать</button><button data-action="danger" type="button" data-reject>Отклонить</button></div></div></article>`; }).join("");
+      const payloadLabels: Record<string, string> = {bait:"Приманка",fishing_method:"Метод ловли",rig_type:"Оснастка",retrieve_method:"Проводка",retrieve_speed:"Скорость проводки",player_name:"Игрок",published_at:"Опубликовано источником",region:"Регион",category:"Категория"};
+      const missingLabels: Record<string, string> = {coordinates:"координаты",weight_g:"вес"};
+      pending.forEach((row: Record<string, unknown>, index: number) => {
+        const card = list.children[index] as HTMLElement | undefined;
+        const summary = card?.querySelector<HTMLElement>(".moderation-summary");
+        if (!summary) return;
+        const payload = Object.entries((row.source_payload as Record<string, unknown>) ?? {});
+        const missing = ((row.missing_fields as string[]) ?? []).map(key => missingLabels[key] ?? key);
+        const details = document.createElement("details");
+        details.className = "moderation-provenance";
+        const sourceCheckLabels: Record<string, string> = {available:"доступен",missing:"не найден",temporary_error:"временная ошибка",blocked:"доступ ограничен"};
+        details.innerHTML = `<summary>Происхождение и исходные поля</summary><dl><div><dt>Впервые замечено</dt><dd>${esc(new Date(String(row.first_seen_at)).toLocaleString("ru-RU"))}</dd></div><div><dt>Последний раз</dt><dd>${esc(new Date(String(row.last_seen_at)).toLocaleString("ru-RU"))}</dd></div><div><dt>Решение модератора</dt><dd>${row.reviewed_at ? esc(new Date(String(row.reviewed_at)).toLocaleString("ru-RU")) : "ещё нет"}</dd></div><div><dt>Проверка источника</dt><dd>${row.source_check_status ? esc(sourceCheckLabels[String(row.source_check_status)] ?? row.source_check_status) : "ещё не выполнялась"}${row.source_checked_at ? ` · ${esc(new Date(String(row.source_checked_at)).toLocaleString("ru-RU"))}` : ""}</dd></div><div><dt>Не хватает</dt><dd>${missing.length ? esc(missing.join(", ")) : "ничего"}</dd></div>${payload.map(([key,value]) => `<div><dt>${esc(payloadLabels[key] ?? key)}</dt><dd>${esc(value)}</dd></div>`).join("")}</dl><p>Показаны только разрешённые поля, сохранённые парсером. Перед публикацией сверьте их с первоисточником.</p>`;
+        summary.append(details);
+      });
     }
     async function changePage(delta: number) {
       const oldOffset = offset;
@@ -56,8 +93,11 @@ const apiUrl = import.meta.env.PUBLIC_API_URL || "http://localhost:8000";
     }
     previous?.addEventListener("click", () => changePage(-50));
     next?.addEventListener("click", () => changePage(50));
-    login?.addEventListener("submit", async event => { event.preventDefault(); offset = 0; token = String(new FormData(login).get("token") || ""); try { await loadQueue(); login.hidden = true; } catch (cause) { setLoading(false); if (list) list.innerHTML = ""; fail(cause instanceof Error ? cause.message : "Ошибка загрузки."); } });
-    list?.addEventListener("click", async event => { const button = (event.target as HTMLElement).closest<HTMLButtonElement>("button"); const card = button?.closest<HTMLElement>("[data-observation-id]"); if (!button || !card || !root) return; button.disabled = true; const base = `${root.dataset.apiUrl}/api/v1/admin/external-observations/${card.dataset.observationId}`; const headers = {Authorization:`Bearer ${token}`,"Content-Type":"application/json"}; try {
+    refresh?.addEventListener("click", async () => { refresh.disabled = true; try { await loadQueue(); succeed("Очередь обновлена."); } catch (cause) { fail(cause instanceof Error ? cause.message : "Не удалось обновить очередь."); } finally { refresh.disabled = false; } });
+    login?.addEventListener("submit", async event => { event.preventDefault(); offset = 0; token = String(new FormData(login).get("token") || ""); try { await loadQueue(); login.hidden = true; if (sessionBar) sessionBar.hidden = false; if (filters) filters.hidden = false; } catch (cause) { setLoading(false); if (list) list.innerHTML = ""; fail(cause instanceof Error ? cause.message : "Ошибка загрузки."); } });
+    filters?.addEventListener("submit", async event => { event.preventDefault(); offset = 0; try { await loadQueue(); } catch (cause) { setLoading(false); fail(cause instanceof Error ? cause.message : "Ошибка фильтрации."); } });
+    logout?.addEventListener("click", () => endSession("Вы вышли из административной панели."));
+    list?.addEventListener("click", async event => { const button = (event.target as HTMLElement).closest<HTMLButtonElement>("button"); const card = button?.closest<HTMLElement>("[data-observation-id]"); if (!button || !card || !root) return; const cardButtons = card.querySelectorAll<HTMLButtonElement>("button"); cardButtons.forEach(item => item.disabled = true); const base = `${root.dataset.apiUrl}/api/v1/admin/external-observations/${card.dataset.observationId}`; const headers = {Authorization:`Bearer ${token}`,"Content-Type":"application/json"}; try {
       if (button.hasAttribute("data-suggest")) {
         const suggestion = await json(`${base}/alias-suggestions`, {headers});
         const fish = fishes.find(item => item.slug === suggestion.fish_slug);
@@ -66,9 +106,10 @@ const apiUrl = import.meta.env.PUBLIC_API_URL || "http://localhost:8000";
         if (message) message.textContent = fish || water
           ? `Ранее подтверждено: рыба — ${fish?.name_ru ?? "нет соответствия"}, водоём — ${water?.name_ru ?? "нет соответствия"}. Проверьте и выберите значения перед сопоставлением.`
           : "Для этого источника подтверждённых соответствий пока нет.";
-        button.disabled = false;
+        cardButtons.forEach(item => item.disabled = false);
         return;
       }
-      if (button.hasAttribute("data-map")) { const fish_slug = card.querySelector<HTMLSelectElement>('[name="fish"]')?.value; const waterbody_slug = card.querySelector<HTMLSelectElement>('[name="waterbody"]')?.value; if (!fish_slug || !waterbody_slug) throw new Error("Выберите рыбу и водоём."); await json(`${base}/mapping`, {method:"PATCH",headers,body:JSON.stringify({fish_slug,waterbody_slug,note:card.querySelector<HTMLTextAreaElement>('[name="note"]')?.value || null})}); } else if (button.hasAttribute("data-publish")) { await json(`${base}/publish`, {method:"POST",headers}); } else if (button.hasAttribute("data-reject")) { const reason = card.querySelector<HTMLTextAreaElement>('[name="note"]')?.value.trim(); if (!reason) throw new Error("Укажите причину отклонения."); await json(`${base}/reject`, {method:"PATCH",headers,body:JSON.stringify({reason})}); } await loadQueue(); } catch (cause) { button.disabled = false; fail(cause instanceof Error ? cause.message : "Ошибка сохранения."); } });
+      let message = "Наблюдение обновлено."; if (button.hasAttribute("data-map")) { const fish_slug = card.querySelector<HTMLSelectElement>('[name="fish"]')?.value; const waterbody_slug = card.querySelector<HTMLSelectElement>('[name="waterbody"]')?.value; if (!fish_slug || !waterbody_slug) throw new Error("Выберите рыбу и водоём."); await json(`${base}/mapping`, {method:"PATCH",headers,body:JSON.stringify({fish_slug,waterbody_slug,note:card.querySelector<HTMLTextAreaElement>('[name="note"]')?.value || null,expected_version:Number(card.dataset.version)})}); message = "Соответствия сохранены."; } else if (button.hasAttribute("data-publish")) { await json(`${base}/publish`, {method:"POST",headers,body:JSON.stringify({expected_version:Number(card.dataset.version)})}); message = "Наблюдение опубликовано."; } else if (button.hasAttribute("data-reject")) { const reason = card.querySelector<HTMLTextAreaElement>('[name="note"]')?.value.trim(); if (!reason) throw new Error("Укажите причину отклонения."); await json(`${base}/reject`, {method:"PATCH",headers,body:JSON.stringify({reason,expected_version:Number(card.dataset.version)})}); message = "Наблюдение отклонено."; } await loadQueue(); succeed(message); list.querySelector<HTMLButtonElement>("button")?.focus(); } catch (cause) { cardButtons.forEach(item => item.disabled = false); fail(cause instanceof Error ? cause.message : "Ошибка сохранения."); } });
+    document.addEventListener("keydown", event => { const target = event.target as HTMLElement; if (target.matches("input,textarea,select") || event.ctrlKey || event.metaKey || event.altKey) return; const card = target.closest<HTMLElement>("[data-observation-id]"); const shortcuts: Record<string, string> = {s:"[data-suggest]",m:"[data-map]",p:"[data-publish]"}; const button = card?.querySelector<HTMLButtonElement>(shortcuts[event.key.toLowerCase()] ?? "[data-no-shortcut]"); if (button && !button.disabled) { event.preventDefault(); button.click(); } });
   </script>
 </Layout>

apps/web/src/pages/admin/index.astro

@@ -0,0 +1,59 @@
+---
+import Layout from "../../layouts/Layout.astro";
+import AdminNav from "../../components/AdminNav.astro";
+const apiUrl = import.meta.env.PUBLIC_API_URL || "http://localhost:8000";
+---
+<Layout title="Административная панель — RF4 Spotter">
+  <section class="form-hero"><div><span class="eyebrow"><b>ADMIN</b> Центр управления</span><h1>Панель<br/><em>модератора</em></h1></div><p>Очереди, состояние источников и последние импорты в одном безопасном обзоре.</p></section>
+  <section class="admin-dashboard" data-api-url={apiUrl}>
+    <AdminNav />
+    <form class="admin-login" autocomplete="off"><label>Административный токен<input name="token" type="password" required autocomplete="off" /></label><button data-action="primary" type="submit">Открыть панель</button></form>
+    <p class="privacy">Токен существует только в памяти вкладки. Сессия завершится после 15 минут бездействия.</p>
+    <div class="admin-session-bar" hidden><span>Административная сессия активна</span><button data-action="secondary" type="button" data-admin-logout>Выйти</button></div>
+    <div class="notice error" data-admin-error role="alert" hidden></div>
+    <div class="notice success" data-admin-status role="status" hidden></div>
+    <section class="admin-dashboard-content" aria-live="polite"></section>
+  </section>
+  <script>
+    import { adminEndsSession, adminErrorMessage } from "../../lib/admin-errors";
+    const root = document.querySelector<HTMLElement>(".admin-dashboard");
+    const login = document.querySelector<HTMLFormElement>(".admin-login");
+    const content = document.querySelector<HTMLElement>(".admin-dashboard-content");
+    const error = document.querySelector<HTMLElement>("[data-admin-error]");
+    const status = document.querySelector<HTMLElement>("[data-admin-status]");
+    const sessionBar = document.querySelector<HTMLElement>(".admin-session-bar");
+    const logout = document.querySelector<HTMLButtonElement>("[data-admin-logout]");
+    let token = "";
+    let sessionTimer: ReturnType<typeof setTimeout> | undefined;
+    const esc = (value: unknown) => String(value ?? "—").replace(/[&<>'"]/g, char => ({"&":"&amp;","<":"&lt;",">":"&gt;","'":"&#39;",'"':"&quot;"}[char] ?? char));
+    const fail = (message: string) => { if (error) { error.textContent = message; error.hidden = false; } };
+    const succeed = (message: string) => { if (error) error.hidden = true; if (status) { status.textContent = message; status.hidden = false; } };
+    const endSession = (message?: string) => { token = ""; if (sessionTimer) clearTimeout(sessionTimer); sessionTimer = undefined; if (login) { login.hidden = false; login.reset(); } if (sessionBar) sessionBar.hidden = true; if (content) content.innerHTML = ""; if (message) fail(message); };
+    const keepSession = () => { if (sessionTimer) clearTimeout(sessionTimer); sessionTimer = setTimeout(() => endSession("Сессия завершена после 15 минут бездействия. Введите токен снова."), 15 * 60 * 1000); };
+    async function authorizedJson(path: string) { const response = await fetch(`${root?.dataset.apiUrl}${path}`, {headers:{Authorization:`Bearer ${token}`}}); if (!response.ok) { if (adminEndsSession(response.status)) endSession(); throw new Error(adminErrorMessage(response.status, "Не удалось загрузить административные данные.")); } keepSession(); return response.json(); }
+    async function loadDashboard() {
+      if (!content) return;
+      error?.setAttribute("hidden", ""); status?.setAttribute("hidden", ""); content.setAttribute("aria-busy", "true"); content.innerHTML = '<div class="loading-grid" aria-hidden="true"><div class="loading-card"></div><div class="loading-card"></div></div>';
+      const diagnostics = await authorizedJson("/api/v1/admin/diagnostics");
+      const [imports, sources, history] = await Promise.all([authorizedJson("/api/v1/admin/imports?limit=5"), authorizedJson("/api/v1/admin/source-status"), authorizedJson("/api/v1/admin/moderation-history?limit=8")]);
+      const reports = diagnostics.counts?.catch_reports ?? {}; const observations = diagnostics.counts?.external_observations ?? {};
+      const sourceLabels: Record<string, string> = {healthy:"Работает",waiting:"Ожидает",stale:"Устарел",disabled:"Отключён",source_changed:"Изменился",temporarily_limited:"Временно недоступен"};
+      const sourceRows = (sources as Record<string, unknown>[]).map(source => { const state = String(source.status); const safeState = Object.hasOwn(sourceLabels, state) ? state : "waiting"; const cooldown = Number(source.cooldown_seconds ?? 0); const detail = cooldown > 0 ? ` · cooldown ${Math.ceil(cooldown / 60)} мин` : source.backoff_recommended ? " · backoff рекомендован" : ""; const success = source.last_success_at ? ` · успех ${new Date(String(source.last_success_at)).toLocaleString("ru-RU")}` : " · успешных запусков нет"; return `<li><span><i class="status-dot ${safeState}"></i>${esc(source.name)}<small>${esc(detail + success)}</small></span><strong>${sourceLabels[safeState]}</strong></li>`; }).join("");
+      const importLabels: Record<string, string> = {running:"Выполняется",success:"Успешно",partial:"Частично",failed:"Ошибка"};
+      const importRows = (imports as Record<string, unknown>[]).map(run => { const status = String(run.status); const rows = Number(run.rows_seen ?? 0); const created = Number(run.rows_created ?? 0); const updated = Number(run.rows_updated ?? 0); const result = rows ? ` · ${rows} строк · +${created}/↻${updated}` : ""; const finished = run.finished_at ? ` · завершён ${new Date(String(run.finished_at)).toLocaleString("ru-RU")}` : ""; return `<li><span>${esc(importLabels[status] ?? status)}<small>${esc(result)}</small></span><time>${esc(new Date(String(run.started_at)).toLocaleString("ru-RU"))}<small>${esc(finished)}</small></time></li>`; }).join("");
+      const actionLabels: Record<string, string> = {approved:"Одобрено",rejected:"Отклонено",pending:"Возвращено на проверку",published:"Опубликовано",mapped:"Сопоставлено",ready:"Готово"};
+      const typeLabels: Record<string, string> = {catch_report:"Улов",external_observation:"Внешнее наблюдение"};
+      const historyRows = (history as Record<string, unknown>[]).map(event => { const action = String(event.action); const type = String(event.entity_type); return `<li><span><b>${esc(typeLabels[type] ?? "Запись")}</b> · ${esc(actionLabels[action] ?? action)}${event.reason ? `<small>${esc(event.reason)}</small>` : ""}</span><time>${esc(new Date(String(event.decided_at)).toLocaleString("ru-RU"))}</time></li>`; }).join("");
+      content.removeAttribute("aria-busy"); content.innerHTML = `<div class="admin-kpis"><a href="/admin/moderation"><span>Уловы на проверке</span><strong>${esc(reports.pending ?? 0)}</strong><small>Открыть очередь →</small></a><a href="/admin/external-sources"><span>Наблюдения в staging</span><strong>${esc((observations.staged ?? 0) + (observations.mapped ?? 0) + (observations.ready ?? 0))}</strong><small>Проверить источники →</small></a><article><span>Одобрено уловов</span><strong>${esc(reports.approved ?? 0)}</strong><small>Участвуют в статистике</small></article><article><span>Источников включено</span><strong>${esc(diagnostics.counts?.enabled_data_sources ?? 0)}</strong><small>из ${esc(diagnostics.counts?.data_sources ?? 0)}</small></article></div><div class="admin-dashboard-grid"><section><div class="admin-section-head"><h2>Состояние источников</h2><button type="button" data-action="secondary" data-refresh>Обновить</button></div><ul>${sourceRows || "<li>Нет данных</li>"}</ul><a href="/status">Публичная страница состояния →</a><br /><a href="/admin/media">Проверить медиа →</a></section><section><div class="admin-section-head"><h2>Последние импорты</h2><button type="button" data-action="secondary" data-official-import>Запустить импорт</button></div><ul>${importRows || "<li>Запусков пока нет</li>"}</ul><p class="privacy">Импорт обращается к официальному источнику и соблюдает cooldown.</p></section><section class="admin-history"><div class="admin-section-head"><h2>Последние решения</h2><button type="button" data-action="secondary" data-history-export>Экспорт JSON</button></div><ul>${historyRows || "<li>Решений пока нет</li>"}</ul><p class="privacy">Экспорт обезличен: без UUID, модератора, причин и исходных данных.</p></section></div>`;
+    }
+    login?.addEventListener("submit", async event => { event.preventDefault(); token = String(new FormData(login).get("token") || ""); try { await loadDashboard(); login.hidden = true; if (sessionBar) sessionBar.hidden = false; } catch (cause) { if (content) { content.removeAttribute("aria-busy"); content.innerHTML = ""; } fail(cause instanceof Error ? cause.message : "Ошибка загрузки."); } });
+    logout?.addEventListener("click", () => endSession("Вы вышли из административной панели."));
+    content?.addEventListener("click", async event => {
+      const button = (event.target as HTMLElement).closest<HTMLButtonElement>("[data-history-export],[data-official-import],[data-refresh]"); if (!button) return;
+      button.disabled = true;
+      try { if (button.hasAttribute("data-refresh")) { await loadDashboard(); succeed("Данные обновлены."); } else if (button.hasAttribute("data-official-import")) { const response = await fetch(`${root?.dataset.apiUrl}/api/v1/admin/imports/official-records`, {method:"POST",headers:{Authorization:`Bearer ${token}`}}); if (!response.ok) { if (adminEndsSession(response.status)) endSession(); throw new Error(response.status === 502 ? "Официальный источник временно недоступен. Старые данные сохранены." : adminErrorMessage(response.status, "Не удалось запустить импорт.")); } keepSession(); await loadDashboard(); succeed("Импорт запущен. Список запусков обновлён."); } else { const response = await fetch(`${root?.dataset.apiUrl}/api/v1/admin/moderation-history-export`, {headers:{Authorization:`Bearer ${token}`}}); if (!response.ok) { if (adminEndsSession(response.status)) endSession(); throw new Error(adminErrorMessage(response.status, "Не удалось выгрузить журнал решений.")); } const blob = await response.blob(); const link = document.createElement("a"); link.href = URL.createObjectURL(blob); link.download = "rf4spotter-moderation-history.json"; link.click(); URL.revokeObjectURL(link.href); keepSession(); } }
+      catch (cause) { fail(cause instanceof Error ? cause.message : "Операция не выполнена."); }
+      finally { button.disabled = false; }
+    });
+  </script>
+</Layout>

apps/web/src/pages/admin/media.astro

@@ -0,0 +1,60 @@
+---
+import Layout from "../../layouts/Layout.astro";
+import AdminNav from "../../components/AdminNav.astro";
+const apiUrl = import.meta.env.PUBLIC_API_URL || "http://localhost:8000";
+---
+<Layout title="Проверка медиа — RF4 Spotter" noindex>
+  <section class="form-hero"><div><span class="eyebrow"><b>ADMIN</b> Media review</span><h1>Проверка<br/><em>медиа</em></h1></div><p>Сравнение approved и upgrade_queued файлов перед отдельным редакционным решением.</p></section>
+  <section class="moderation-app" data-api-url={apiUrl}>
+    <AdminNav />
+    <form class="admin-login" autocomplete="off"><label>Административный токен<input name="token" type="password" required autocomplete="off" /></label><button data-action="primary" type="submit">Открыть медиатеку</button></form>
+    <p class="privacy">Публикация требует явной причины и атомарно сохраняет fallback для rollback. Токен хранится только в памяти страницы.</p>
+    <div class="admin-session-bar" hidden><span>Административная сессия активна</span><button data-action="secondary" type="button" data-admin-logout>Выйти</button></div>
+    <form class="admin-queue-filters" hidden><label>Тип<select name="entity_type"><option value="">Все типы</option><option value="fish">Рыбы</option><option value="waterbody">Водоёмы</option><option value="tackle">Снасти</option><option value="reference">Справка</option></select></label><label>Состояние<select name="status"><option value="">Все состояния</option><option value="approved">Approved</option><option value="upgrade_queued">Upgrade queued</option><option value="upgrade_stored">Upgrade stored</option></select></label><button data-action="primary" type="submit">Применить</button></form>
+    <div class="notice error" data-admin-error role="alert" hidden></div><div class="notice success" data-admin-status role="status" hidden></div><section class="media-library__grid" data-media-list aria-live="polite"></section>
+    <nav data-pages aria-label="Страницы медиатеки" hidden><button data-action="secondary" type="button" data-previous>Предыдущая</button><span data-page-number aria-live="polite"></span><button data-action="secondary" type="button" data-next>Следующая</button><button data-action="secondary" type="button" data-refresh>Обновить</button></nav>
+  </section>
+  <script>
+    import { adminEndsSession, adminErrorMessage } from "../../lib/admin-errors";
+    const root = document.querySelector<HTMLElement>("[data-api-url]");
+    const login = document.querySelector<HTMLFormElement>(".admin-login");
+    const filters = document.querySelector<HTMLFormElement>(".admin-queue-filters");
+    const list = document.querySelector<HTMLElement>("[data-media-list]");
+    const error = document.querySelector<HTMLElement>("[data-admin-error]");
+    const status = document.querySelector<HTMLElement>("[data-admin-status]");
+    const sessionBar = document.querySelector<HTMLElement>(".admin-session-bar");
+    const logout = document.querySelector<HTMLButtonElement>("[data-admin-logout]");
+    const pages = document.querySelector<HTMLElement>("[data-pages]");
+    const previous = document.querySelector<HTMLButtonElement>("[data-previous]");
+    const next = document.querySelector<HTMLButtonElement>("[data-next]");
+    const refresh = document.querySelector<HTMLButtonElement>("[data-refresh]");
+    const pageNumber = document.querySelector<HTMLElement>("[data-page-number]");
+    let token = ""; let offset = 0; let timer: ReturnType<typeof setTimeout> | undefined;
+    const esc = (value: unknown) => String(value ?? "—").replace(/[&<>'"]/g, char => ({"&":"&amp;","<":"&lt;",">":"&gt;","'":"&#39;",'"':"&quot;"}[char] ?? char));
+    const url = (value: unknown) => { try { const parsed = new URL(String(value), root?.dataset.apiUrl); return parsed.protocol === "http:" || parsed.protocol === "https:" ? esc(parsed.href) : ""; } catch { return ""; } };
+    const fail = (message: string) => { if (status) status.hidden = true; if (error) { error.textContent = message; error.hidden = false; } };
+    const succeed = (message: string) => { if (error) error.hidden = true; if (status) { status.textContent = message; status.hidden = false; } };
+    const endSession = (message?: string) => { token = ""; if (timer) clearTimeout(timer); timer = undefined; if (login) { login.hidden = false; login.reset(); } if (filters) filters.hidden = true; if (sessionBar) sessionBar.hidden = true; if (list) list.innerHTML = ""; pages?.setAttribute("hidden", ""); if (message) fail(message); };
+    const keepSession = () => { if (timer) clearTimeout(timer); timer = setTimeout(() => endSession("Сессия завершена после 15 минут бездействия. Введите токен снова."), 15 * 60 * 1000); };
+    const loading = () => '<div class="loading-card" aria-hidden="true"></div><span class="sr-only">Загружаем медиа</span>';
+    async function load() {
+      if (!root || !list || !filters) return;
+      error?.setAttribute("hidden", ""); list.innerHTML = loading(); list.setAttribute("aria-busy", "true");
+      const values = new FormData(filters); const params = new URLSearchParams({limit:"51", offset:String(offset)}); for (const key of ["entity_type", "status"]) { const value = String(values.get(key) || ""); if (value) params.set(key, value); }
+      const response = await fetch(`${root.dataset.apiUrl}/api/v1/admin/media/catalog?${params}`, {headers:{Authorization:`Bearer ${token}`} });
+      if (!response.ok) { if (adminEndsSession(response.status)) endSession(); throw new Error(adminErrorMessage(response.status, "Не удалось загрузить медиатеку.")); }
+      const rows: Record<string, unknown>[] = await response.json(); keepSession(); list.removeAttribute("aria-busy");
+      if (!rows.length && offset > 0) { offset = 0; return load(); }
+      const assets = rows.slice(0, 50); if (pages) pages.hidden = !assets.length; if (previous) previous.disabled = offset === 0; if (next) next.disabled = rows.length <= 50; if (pageNumber) pageNumber.textContent = `Страница ${offset / 50 + 1}`;
+      if (!assets.length) { list.innerHTML = '<div class="state"><h2>Кандидатов нет</h2><p>Для выбранных фильтров нет approved или upgrade_queued файлов.</p></div>'; return; }
+      list.innerHTML = assets.map(asset => { const image = url(asset.image_url); const source = url(asset.source_url); const variants = (asset.derivatives as Record<string, unknown>[] ?? []).map(item => `${esc(item.format)} ${esc(item.width)}×${esc(item.height)}`).join(", "); const rollback = asset.status === "approved" && asset.supersedes ? `<button data-media-rollback="${esc(asset.asset_url)}" type="button" data-action="secondary">Откатить замену</button>` : ""; return `<article class="media-library__card"><a href="${image}" target="_blank" rel="noreferrer">${image ? `<img src="${image}" alt="${esc(asset.label)}" loading="lazy" />` : ""}</a><h2>${esc(asset.label)}</h2><span>${esc(asset.status)} · ${esc(asset.entity_type)} · ${esc(asset.width)}×${esc(asset.height)}</span><p>${esc(asset.source_system)}${asset.duplicate_of ? ` · duplicate_of ${esc(asset.duplicate_of)}` : ""}</p>${variants ? `<small>Производные: ${variants}</small>` : "<small>Производных нет</small>"}${source ? `<a href="${source}" target="_blank" rel="noreferrer">Первоисточник →</a>` : ""}${rollback}</article>`; }).join("");
+      list.querySelectorAll<HTMLButtonElement>("[data-media-rollback]").forEach(button => button.addEventListener("click", async () => { const note = window.prompt("Причина отката:"); if (!note?.trim()) return; button.disabled = true; try { const response = await fetch(`${root?.dataset.apiUrl}/api/v1/admin/media/upgrades/rollback`, {method:"POST", headers:{Authorization:`Bearer ${token}`, "Content-Type":"application/json"}, body:JSON.stringify({asset_url:button.dataset.mediaRollback, note:note.trim()})}); if (!response.ok) throw new Error(adminErrorMessage(response.status, "Не удалось выполнить откат.")); succeed("Fallback восстановлен."); await load(); } catch (cause) { fail(cause instanceof Error ? cause.message : "Не удалось выполнить откат."); } finally { button.disabled = false; } }));
+      if (assets.some(asset => asset.status === "upgrade_stored")) { const publish = document.createElement("button"); publish.type = "button"; publish.dataset.action = "primary"; publish.textContent = "Опубликовать сохранённые замены"; publish.addEventListener("click", async () => { const note = window.prompt("Причина публикации замен:"); if (!note?.trim()) return; publish.disabled = true; try { const response = await fetch(`${root?.dataset.apiUrl}/api/v1/admin/media/upgrades/publish`, {method:"POST", headers:{Authorization:`Bearer ${token}`, "Content-Type":"application/json"}, body:JSON.stringify({note:note.trim()})}); if (!response.ok) throw new Error(adminErrorMessage(response.status, "Не удалось опубликовать замены.")); succeed("Замены опубликованы атомарно, fallback сохранены."); await load(); } catch (cause) { fail(cause instanceof Error ? cause.message : "Не удалось опубликовать замены."); } finally { publish.disabled = false; } }); list.prepend(publish); }
+    }
+    login?.addEventListener("submit", async event => { event.preventDefault(); token = String(new FormData(login).get("token") || ""); offset = 0; try { await load(); login.hidden = true; if (sessionBar) sessionBar.hidden = false; if (filters) filters.hidden = false; } catch (cause) { list && (list.innerHTML = ""); fail(cause instanceof Error ? cause.message : "Ошибка загрузки."); } });
+    filters?.addEventListener("submit", async event => { event.preventDefault(); offset = 0; try { await load(); } catch (cause) { fail(cause instanceof Error ? cause.message : "Ошибка фильтрации."); } });
+    const move = async (delta: number) => { offset = Math.max(0, offset + delta); try { await load(); } catch (cause) { fail(cause instanceof Error ? cause.message : "Ошибка загрузки страницы."); } };
+    previous?.addEventListener("click", () => move(-50)); next?.addEventListener("click", () => move(50)); refresh?.addEventListener("click", async () => { refresh.disabled = true; try { await load(); succeed("Медиатека обновлена."); } catch (cause) { fail(cause instanceof Error ? cause.message : "Не удалось обновить медиатеку."); } finally { refresh.disabled = false; } });
+    logout?.addEventListener("click", () => endSession("Вы вышли из административной панели."));
+  </script>
+</Layout>

apps/web/src/pages/admin/moderation.astro

@@ -1,42 +1,75 @@
 ---
 import Layout from "../../layouts/Layout.astro";
+import AdminNav from "../../components/AdminNav.astro";
 const apiUrl = import.meta.env.PUBLIC_API_URL || "http://localhost:8000";
 ---
 <Layout title="Модерация уловов — RF4 Spotter">
   <section class="form-hero"><div><span class="eyebrow"><b>ADMIN</b> Очередь проверки</span><h1>Модерация<br/><em>уловов</em></h1></div><p>Проверьте данные и скриншот до того, как запись повлияет на публичную статистику.</p></section>
   <section class="moderation-app" data-api-url={apiUrl}>
+    <AdminNav />
     <form class="admin-login" autocomplete="off"><label>Административный токен<input name="token" type="password" required autocomplete="off" /></label><button data-action="primary" type="submit">Открыть очередь</button></form>
     <p class="privacy">Токен хранится только в памяти страницы и не записывается в URL или localStorage.</p>
-    <div class="notice error" data-admin-error role="alert" hidden></div><div class="moderation-list" data-moderation-list aria-live="polite"></div>
+    <div class="admin-session-bar" hidden><span>Административная сессия активна</span><button data-action="secondary" type="button" data-admin-logout>Выйти</button></div>
+    <div class="notice error" data-admin-error role="alert" hidden></div><div class="notice success" data-admin-status role="status" hidden></div><div class="moderation-list" data-moderation-list aria-live="polite"></div>
+    <nav data-pages aria-label="Страницы очереди" hidden><button data-action="secondary" type="button" data-previous>Предыдущая</button><span data-page-number aria-live="polite"></span><button data-action="secondary" type="button" data-next>Следующая</button><button data-action="secondary" type="button" data-refresh>Обновить</button></nav>
+    <p class="admin-shortcuts"><kbd>A</kbd> одобрить карточку с фокусом · отклонение и удаление — только кнопками</p>
   </section>
   <script>
+    import { adminEndsSession, adminErrorMessage } from "../../lib/admin-errors";
     const root = document.querySelector<HTMLElement>(".moderation-app");
     const login = document.querySelector<HTMLFormElement>(".admin-login");
     const list = document.querySelector<HTMLElement>("[data-moderation-list]");
     const error = document.querySelector<HTMLElement>("[data-admin-error]");
+    const status = document.querySelector<HTMLElement>("[data-admin-status]");
+    const pages = document.querySelector<HTMLElement>("[data-pages]");
+    const previous = document.querySelector<HTMLButtonElement>("[data-previous]");
+    const next = document.querySelector<HTMLButtonElement>("[data-next]");
+    const refresh = document.querySelector<HTMLButtonElement>("[data-refresh]");
+    const pageNumber = document.querySelector<HTMLElement>("[data-page-number]");
+    const sessionBar = document.querySelector<HTMLElement>(".admin-session-bar");
+    const logout = document.querySelector<HTMLButtonElement>("[data-admin-logout]");
     let token = "";
+    let offset = 0;
+    let sessionTimer: ReturnType<typeof setTimeout> | undefined;
     const loadingCards = () => `<div class="loading-grid" aria-hidden="true">${Array.from({length:2}, () => '<div class="loading-card"><span class="loading-line loading-line--label"></span><span class="loading-line loading-line--title"></span><span class="loading-line"></span><span class="loading-line loading-line--short"></span></div>').join("")}</div><span class="sr-only">Загружаем очередь модерации</span>`;
     const setLoading = (loading: boolean) => list?.setAttribute("aria-busy", String(loading));
     const esc = (value: unknown) => String(value ?? "—").replace(/[&<>'"]/g, char => ({"&":"&amp;","<":"&lt;",">":"&gt;","'":"&#39;",'"':"&quot;"}[char] ?? char));
-    const fail = (message: string) => { if (error) { error.textContent = message; error.hidden = false; } };
+    const safeHttpUrl = (value: unknown) => { try { const url = new URL(String(value)); return url.protocol === "http:" || url.protocol === "https:" ? esc(url.href) : ""; } catch { return ""; } };
+    const fail = (message: string) => { if (status) status.hidden = true; if (error) { error.textContent = message; error.hidden = false; } };
+    const succeed = (message: string) => { if (error) error.hidden = true; if (status) { status.textContent = message; status.hidden = false; } };
+    const endSession = (message?: string) => { token = ""; if (sessionTimer) clearTimeout(sessionTimer); sessionTimer = undefined; if (login) { login.hidden = false; login.reset(); } if (sessionBar) sessionBar.hidden = true; if (list) list.innerHTML = ""; if (message) fail(message); };
+    const keepSession = () => { if (sessionTimer) clearTimeout(sessionTimer); sessionTimer = setTimeout(() => endSession("Сессия завершена после 15 минут бездействия. Введите токен снова."), 15 * 60 * 1000); };
     async function loadQueue() {
       if (!root || !list) return;
       error?.setAttribute("hidden", ""); setLoading(true); list.innerHTML = loadingCards();
-      const response = await fetch(`${root.dataset.apiUrl}/api/v1/admin/catch-reports?status=pending`, {headers:{Authorization:`Bearer ${token}`}});
-      if (!response.ok) throw new Error(response.status === 401 ? "Неверный административный токен." : "Не удалось загрузить очередь.");
-      const reports: Record<string, unknown>[] = await response.json();
+      const response = await fetch(`${root.dataset.apiUrl}/api/v1/admin/catch-reports?status=pending&limit=51&offset=${offset}`, {headers:{Authorization:`Bearer ${token}`} });
+      if (!response.ok) { if (adminEndsSession(response.status)) endSession(); throw new Error(adminErrorMessage(response.status, "Не удалось загрузить очередь.")); }
+      const rows: Record<string, unknown>[] = await response.json();
+      keepSession();
       setLoading(false);
+      if (!rows.length && offset > 0) { offset = 0; return loadQueue(); }
+      const reports = rows.slice(0, 50);
+      if (pages) pages.hidden = !reports.length;
+      if (previous) previous.disabled = offset === 0;
+      if (next) next.disabled = rows.length <= 50;
+      if (pageNumber) pageNumber.textContent = `Страница ${offset / 50 + 1}`;
       if (!reports.length) { list.innerHTML = '<div class="state"><h2>Очередь пуста</h2><p>Новых уловов для проверки нет.</p></div>'; return; }
-      list.innerHTML = reports.map(report => `<article class="moderation-card" data-report-id="${esc(report.id)}"><div class="moderation-summary"><span class="activity-pill"><i></i>На проверке</span><h2>${esc(report.fish)}</h2><p>${esc(report.waterbody)} · ${esc(report.coordinates)}</p><dl><div><dt>Вес</dt><dd>${esc(report.weight_g)} г</dd></div><div><dt>Приманка</dt><dd>${esc(report.bait)}</dd></div><div><dt>Игрок</dt><dd>${esc(report.player_name)}</dd></div><div><dt>Отправлено</dt><dd>${esc(new Date(String(report.reported_at)).toLocaleString("ru-RU"))}</dd></div></dl>${report.comment ? `<blockquote>${esc(report.comment)}</blockquote>` : ""}</div><div class="moderation-proof">${report.screenshot_url ? `<a href="${esc(report.screenshot_url)}" target="_blank" rel="noreferrer"><img src="${esc(report.screenshot_url)}" alt="Скриншот улова ${esc(report.fish)}" /></a>` : '<div class="no-proof">Скриншот не приложен</div>'}</div><div class="moderation-actions"><label>Причина решения<textarea rows="2" maxlength="1000"></textarea></label><div><button data-action="primary" type="button" data-decision="approved">Одобрить</button><button data-action="danger" type="button" data-decision="rejected">Отклонить</button><button data-action="quiet-danger" type="button" data-delete>Удалить</button></div></div></article>`).join("");
+      list.innerHTML = reports.map(report => { const screenshotUrl = safeHttpUrl(report.screenshot_url); return `<article class="moderation-card" data-report-id="${esc(report.id)}" data-version="${esc(report.moderation_version)}"><div class="moderation-summary"><span class="activity-pill"><i></i>На проверке</span><h2>${esc(report.fish)}</h2><p>${esc(report.waterbody)} · ${esc(report.coordinates)}</p><dl><div><dt>Вес</dt><dd>${esc(report.weight_g)} г</dd></div><div><dt>Приманка</dt><dd>${esc(report.bait)}</dd></div><div><dt>Игрок</dt><dd>${esc(report.player_name)}</dd></div><div><dt>Отправлено</dt><dd>${esc(new Date(String(report.reported_at)).toLocaleString("ru-RU"))}</dd></div></dl>${report.comment ? `<blockquote>${esc(report.comment)}</blockquote>` : ""}</div><div class="moderation-proof">${screenshotUrl ? `<a href="${screenshotUrl}" target="_blank" rel="noreferrer"><img src="${screenshotUrl}" alt="Скриншот улова ${esc(report.fish)}" /></a>` : '<div class="no-proof">Скриншот не приложен</div>'}</div><div class="moderation-actions"><label>Причина решения<textarea rows="2" maxlength="1000"></textarea></label><div><button data-action="primary" type="button" data-decision="approved">Одобрить</button><button data-action="danger" type="button" data-decision="rejected">Отклонить</button><button data-action="quiet-danger" type="button" data-delete>Удалить</button></div></div></article>`; }).join("");
     }
-    login?.addEventListener("submit", async event => { event.preventDefault(); token = String(new FormData(login).get("token") || ""); try { await loadQueue(); login.hidden = true; } catch (cause) { setLoading(false); if (list) list.innerHTML = ""; fail(cause instanceof Error ? cause.message : "Ошибка загрузки."); } });
+    async function changePage(delta: number) { const oldOffset = offset; offset = Math.max(0, offset + delta); if (previous) previous.disabled = true; if (next) next.disabled = true; try { await loadQueue(); } catch { offset = oldOffset; setLoading(false); fail("Не удалось загрузить страницу очереди."); } }
+    previous?.addEventListener("click", () => changePage(-50));
+    next?.addEventListener("click", () => changePage(50));
+    refresh?.addEventListener("click", async () => { refresh.disabled = true; try { await loadQueue(); succeed("Очередь обновлена."); } catch (cause) { fail(cause instanceof Error ? cause.message : "Не удалось обновить очередь."); } finally { refresh.disabled = false; } });
+    login?.addEventListener("submit", async event => { event.preventDefault(); offset = 0; token = String(new FormData(login).get("token") || ""); try { await loadQueue(); login.hidden = true; if (sessionBar) sessionBar.hidden = false; } catch (cause) { setLoading(false); if (list) list.innerHTML = ""; fail(cause instanceof Error ? cause.message : "Ошибка загрузки."); } });
+    logout?.addEventListener("click", () => endSession("Вы вышли из административной панели."));
     list?.addEventListener("click", async event => {
       const button = (event.target as HTMLElement).closest<HTMLButtonElement>("button[data-decision],button[data-delete]"); const card = button?.closest<HTMLElement>("[data-report-id]"); if (!button || !card || !root) return;
       const reason = card.querySelector<HTMLTextAreaElement>("textarea")?.value.trim() || null;
       if (button.dataset.decision === "rejected" && !reason) { fail("Укажите причину отклонения."); card.querySelector("textarea")?.focus(); return; }
       if (button.hasAttribute("data-delete") && !window.confirm("Удалить и обезличить эту заявку? Действие нельзя отменить.")) return;
-      button.disabled = true;
-      try { const deleting = button.hasAttribute("data-delete"); const response = await fetch(`${root.dataset.apiUrl}/api/v1/admin/catch-reports/${card.dataset.reportId}`, {method:deleting ? "DELETE" : "PATCH",headers:{Authorization:`Bearer ${token}`,"Content-Type":"application/json"},body:deleting ? undefined : JSON.stringify({status:button.dataset.decision,reason})}); if (!response.ok) throw new Error("Не удалось сохранить решение."); card.remove(); if (list && !list.children.length) list.innerHTML = '<div class="state"><h2>Очередь пуста</h2><p>Все записи обработаны.</p></div>'; } catch (cause) { button.disabled = false; fail(cause instanceof Error ? cause.message : "Ошибка сохранения."); }
+      const cardButtons = card.querySelectorAll<HTMLButtonElement>("button"); cardButtons.forEach(item => item.disabled = true);
+      try { const deleting = button.hasAttribute("data-delete"); const decision = deleting ? "Заявка удалена и обезличена." : button.dataset.decision === "approved" ? "Улов одобрен и опубликован." : "Улов отклонён."; const response = await fetch(`${root.dataset.apiUrl}/api/v1/admin/catch-reports/${card.dataset.reportId}${deleting ? `?expected_version=${card.dataset.version}` : ""}`, {method:deleting ? "DELETE" : "PATCH",headers:{Authorization:`Bearer ${token}`,"Content-Type":"application/json"},body:deleting ? undefined : JSON.stringify({status:button.dataset.decision,reason,expected_version:Number(card.dataset.version)})}); if (response.status === 409) { await loadQueue(); throw new Error("Запись уже изменена в другой вкладке. Очередь обновлена."); } if (!response.ok) { if (adminEndsSession(response.status)) endSession(); throw new Error(adminErrorMessage(response.status, "Не удалось сохранить решение.")); } keepSession(); card.remove(); succeed(decision); const nextAction = list.querySelector<HTMLButtonElement>("button[data-decision]"); if (nextAction) nextAction.focus(); else list.innerHTML = '<div class="state"><h2>Очередь пуста</h2><p>Все записи обработаны.</p></div>'; } catch (cause) { cardButtons.forEach(item => item.disabled = false); fail(cause instanceof Error ? cause.message : "Ошибка сохранения."); }
     });
+    document.addEventListener("keydown", event => { const target = event.target as HTMLElement; if (event.key.toLowerCase() !== "a" || target.matches("input,textarea,select") || event.ctrlKey || event.metaKey || event.altKey) return; const card = target.closest<HTMLElement>("[data-report-id]"); const approve = card?.querySelector<HTMLButtonElement>('[data-decision="approved"]'); if (approve && !approve.disabled) { event.preventDefault(); approve.click(); } });
   </script>
 </Layout>

apps/web/src/pages/api/v1/media/assets/[digest].ts

@@ -0,0 +1,21 @@
+import type { APIRoute } from "astro";
+
+const apiBase = process.env.API_INTERNAL_URL || import.meta.env.API_INTERNAL_URL || "http://localhost:8000";
+
+export const GET: APIRoute = async ({ params }) => {
+  const digest = params.digest ?? "";
+  if (!/^[a-f0-9]{64}$/.test(digest)) return new Response("Not found", { status: 404 });
+
+  try {
+    const upstream = await fetch(`${apiBase}/api/v1/media/assets/${digest}`);
+    if (!upstream.ok || !upstream.body) return new Response("Not found", { status: upstream.status === 404 ? 404 : 502 });
+    const headers = new Headers();
+    for (const name of ["content-type", "content-length", "cache-control", "etag"]) {
+      const value = upstream.headers.get(name);
+      if (value) headers.set(name, value);
+    }
+    return new Response(upstream.body, { status: 200, headers });
+  } catch {
+    return new Response("Media service unavailable", { status: 502 });
+  }
+};

apps/web/src/pages/fish/[slug].astro

@@ -1,15 +1,18 @@
 ---
 import ActivityCard from "../../components/ActivityCard.astro";
+import EntityMedia from "../../components/EntityMedia.astro";
 import AtlasBreadcrumbs from "../../components/AtlasBreadcrumbs.astro";
 import AtlasEntityLink from "../../components/AtlasEntityLink.astro";
 import PageHero from "../../components/PageHero.astro";
 import StatePanel from "../../components/StatePanel.astro";
 import Layout from "../../layouts/Layout.astro";
-import { api, plural, type Activity, type DictionaryItem, type PaginatedActivity } from "../../lib/api";
+import { api, plural, type Activity, type DictionaryItem, type MediaAsset, type PaginatedActivity } from "../../lib/api";
+import { findMediaByLabel } from "../../lib/media";
 const { slug } = Astro.params;
-let fish: DictionaryItem | undefined, items: Activity[] = [], unavailable = false;
+let fish: DictionaryItem | undefined, items: Activity[] = [], media: MediaAsset[] = [], unavailable = false;
 try {
-  const fishes = await api<DictionaryItem[]>("/api/v1/fishes?limit=500");
+  const [fishes, fishMedia] = await Promise.all([api<DictionaryItem[]>("/api/v1/fishes?limit=500"), api<MediaAsset[]>("/api/v1/media/catalog?entity_type=fish")]);
+  media = fishMedia;
   fish = fishes.find(item => item.slug === slug);
   if (fish) { const paginated = await api<PaginatedActivity>(`/api/v1/activity?hours=72&fish=${encodeURIComponent(fish.slug)}&limit=100`); items = paginated.items; }
 } catch { unavailable = true; }
@@ -20,10 +23,12 @@ if (unavailable) {
 }
 if (!fish && !unavailable) Astro.response.status = 404;
 const waters = [...new Map(items.map(item => [item.waterbody_slug, item.waterbody])).entries()];
+const image = fish ? findMediaByLabel(media, fish.name_ru) : undefined;
 const schema = fish ? { "@context":"https://schema.org", "@type":"CollectionPage", name:`Где ловить ${fish.name_ru} в RF4`, url:`https://rf4spotter.ru/fish/${fish.slug}` } : null;
 ---
 <Layout title={fish ? `Где ловить ${fish.name_ru} в RF4 — свежие точки` : "Рыба не найдена — RF4 Spotter"} description={fish ? `Свежие точки ловли ${fish.name_ru} в Russian Fishing 4: водоёмы, координаты, приманки, активность и источники наблюдений.` : "Такого вида рыбы нет в каталоге RF4 Spotter."} noindex={!fish || unavailable} structuredData={schema} errorPage={!fish || unavailable}>
   <AtlasBreadcrumbs items={[{ label: "Рыбы", href: "/fish" }, { label: fish?.name_ru ?? "Не найдено" }]} />
   <PageHero eyebrow="Свежие данные за 72 часа" title={fish?.name_ru ?? "Рыба не найдена"} description={fish ? `${items.length} ${plural(items.length,["активная точка","активные точки","активных точек"])} на ${waters.length} ${plural(waters.length,["водоёме","водоёмах","водоёмах"])}.` : undefined} variant={fish ? "fish" : undefined} identity={fish?.name_ru} />
-  {unavailable ? <StatePanel tone="unavailable" title="Данные временно недоступны" description="Каталог сохранён, но свежие наблюдения сейчас не получены." /> : !fish ? <StatePanel tone="error" title="Такой рыбы нет в справочнике" actionHref="/fish" actionLabel="Открыть каталог" /> : <section class="catalog-results content-grid"><aside><span class="overline">Водоёмы</span>{waters.length ? <nav>{waters.map(([waterSlug,name]) => <AtlasEntityLink href={`/waterbodies/${waterSlug}/${fish!.slug}`} label={name} kind="water" identity={waterSlug} />)}</nav> : <p>Свежих подтверждённых водоёмов пока нет.</p>}</aside><div>{items.length ? items.map(item => <ActivityCard item={item}/>) : <StatePanel contained={false} title="Свежих точек пока нет" description="Проверьте позже или посмотрите полевые сигналы на главной." />}</div></section>}
+  {image && <section class="entity-feature content-grid" aria-label={`Изображение: ${fish!.name_ru}`}><EntityMedia asset={image} sourceLink /><div><span class="overline">Визуальный справочник</span><h2>{fish!.name_ru}</h2><p>Изображение опубликовано с прямой ссылкой на источник. Оно помогает отличить вид, а актуальные точки ниже остаются отдельными наблюдениями игроков.</p></div></section>}
+  {unavailable ? <StatePanel tone="unavailable" title="Данные временно недоступны" description="Каталог сохранён, но свежие наблюдения сейчас не получены." /> : !fish ? <StatePanel tone="error" title="Такой рыбы нет в справочнике" actionHref="/fish" actionLabel="Открыть каталог" /> : <section class="catalog-results content-grid"><aside><span class="overline">Водоёмы</span>{waters.length ? <nav>{waters.map(([waterSlug,name]) => <AtlasEntityLink href={`/waterbodies/${waterSlug}/${fish!.slug}`} label={name} kind="water" identity={waterSlug} />)}</nav> : <p>Свежих подтверждённых водоёмов пока нет.</p>}</aside><div>{items.length ? items.map(item => <ActivityCard item={item} periodLabel="72 часа"/>) : <StatePanel contained={false} title="Свежих точек пока нет" description="Проверьте позже или посмотрите полевые сигналы на главной." />}</div></section>}
 </Layout>

apps/web/src/pages/fish/index.astro

@@ -1,11 +1,22 @@
 ---
 import Layout from "../../layouts/Layout.astro";
 import FishSilhouette from "../../components/FishSilhouette.astro";
+import EntityMedia from "../../components/EntityMedia.astro";
 import PageHero from "../../components/PageHero.astro";
 import StatePanel from "../../components/StatePanel.astro";
-import { api, type DictionaryItem } from "../../lib/api";
-let fishes: DictionaryItem[] = [], unavailable = false;
-try { fishes = await api<DictionaryItem[]>("/api/v1/fishes?limit=500"); } catch { unavailable = true; }
+import Pagination from "../../components/Pagination.astro";
+import { api, type DictionaryItem, type MediaAsset } from "../../lib/api";
+import { findMediaByLabel } from "../../lib/media";
+const params = Astro.url.searchParams;
+const pageLimit = 48;
+const requestedOffset = Number(params.get("offset") ?? 0);
+let offset = Number.isInteger(requestedOffset) && requestedOffset >= 0 ? requestedOffset : 0;
+let fishes: DictionaryItem[] = [], allFishes: DictionaryItem[] = [], media: MediaAsset[] = [], unavailable = false;
+try {
+  [allFishes, media] = await Promise.all([api<DictionaryItem[]>("/api/v1/fishes?limit=500"), api<MediaAsset[]>("/api/v1/media/catalog?entity_type=fish")]);
+  if (allFishes.length > 0 && offset >= allFishes.length) offset = Math.floor((allFishes.length - 1) / pageLimit) * pageLimit;
+  fishes = allFishes.slice(offset, offset + pageLimit);
+} catch { unavailable = true; }
 if (unavailable) {
   Astro.response.status = 503;
   Astro.response.headers.set("Retry-After", "60");
@@ -13,6 +24,7 @@ if (unavailable) {
 }
 ---
 <Layout title="Все виды рыб Russian Fishing 4 — RF4 Spotter" description="Каталог рыб RF4 со свежими точками, уловами, приманками и прозрачными источниками данных.">
-  <PageHero eyebrow="Справочник RF4" title="Рыбы" description="Выберите вид, чтобы увидеть свежие подтверждённые точки и полевые сигналы." variant="fish" count={fishes.length} />
-  {unavailable ? <StatePanel tone="unavailable" title="Каталог временно недоступен" description="Не показываем непроверенный список. Попробуйте обновить страницу позже." /> : <nav class="catalog-grid content-grid" aria-label="Виды рыб">{fishes.map((fish,index) => <a href={`/fish/${fish.slug}`}><span>Вид рыбы · {String(index + 1).padStart(2,"0")}</span><strong>{fish.name_ru}</strong><i>Открыть <b>→</b></i><FishSilhouette name={fish.name_ru} size={92}/></a>)}</nav>}
+  <PageHero eyebrow="Справочник RF4" title="Рыбы" description="Выберите вид, чтобы увидеть свежие подтверждённые точки и полевые сигналы." variant="fish" count={allFishes.length} />
+  {unavailable ? <StatePanel tone="unavailable" title="Каталог временно недоступен" description="Не показываем непроверенный список. Попробуйте обновить страницу позже." /> : <nav class="catalog-grid content-grid" aria-label="Виды рыб">{fishes.map((fish,index) => { const asset = findMediaByLabel(media, fish.name_ru); return <a href={`/fish/${fish.slug}`}><span>Вид рыбы · {String(offset + index + 1).padStart(2,"0")}</span><strong>{fish.name_ru}</strong><i>Открыть <b>→</b></i>{asset ? <EntityMedia asset={asset} compact /> : <FishSilhouette name={fish.name_ru} size={92}/>}</a>; })}</nav>}
+  {!unavailable && <Pagination path="/fish" params={params} total={allFishes.length} limit={pageLimit} offset={offset} itemLabel="видов" />}
 </Layout>

apps/web/src/pages/index.astro

@@ -5,6 +5,8 @@ import FishingIcon from "../components/FishingIcon.astro";
 import SourceBadge from "../components/SourceBadge.astro";
 import TackleGlyph from "../components/TackleGlyph.astro";
 import SignalFeed from "../components/SignalFeed.astro";
+import StatePanel from "../components/StatePanel.astro";
+import Pagination from "../components/Pagination.astro";
 import { activityLevel, ago, api, kg, plural, type Activity, type DictionaryItem, type PaginatedActivity, type PublicObservation } from "../lib/api";
 
 const params = Astro.url.searchParams;
@@ -12,41 +14,62 @@ const hours = params.get("hours") ?? "24";
 const waterbody = params.get("waterbody") ?? "";
 const fish = params.get("fish") ?? "";
 const sort = params.get("sort") ?? "activity";
+const activityLimit = 20;
 const requestedOffset = Number(params.get("offset") ?? 0);
-const offset = Number.isInteger(requestedOffset) && requestedOffset >= 0 ? requestedOffset : 0;
+let offset = Number.isInteger(requestedOffset) && requestedOffset >= 0 ? requestedOffset : 0;
 const requestedSignalLimit = Number(params.get("signals") ?? 12);
 const signalLimit = Number.isInteger(requestedSignalLimit) ? Math.min(48, Math.max(12, requestedSignalLimit)) : 12;
 let items: Activity[] = [], signals: PublicObservation[] = [], fishes: DictionaryItem[] = [], waterbodies: DictionaryItem[] = [];
 let hasMoreSignals = false, totalItems = 0;
 const filterError = !["6", "12", "24", "72"].includes(hours) || !["activity", "confidence", "freshness"].includes(sort);
-let unavailable = false, showNoIndex = false;
+let activityUnavailable = false, signalsUnavailable = false, fishCatalogUnavailable = false, waterCatalogUnavailable = false, showNoIndex = false;
 if (filterError) { showNoIndex = true; Astro.response.status = 422; }
-try {
-  let signalRows: PublicObservation[] = [];
-  const signalParams = new URLSearchParams({ limit: String(signalLimit + 1) });
-  if (waterbody) signalParams.set("waterbody", waterbody);
-  if (fish) signalParams.set("fish", fish);
-  [fishes, waterbodies, signalRows] = await Promise.all([api<DictionaryItem[]>("/api/v1/fishes"), api<DictionaryItem[]>("/api/v1/waterbodies"), api<PublicObservation[]>(`/api/v1/community-observations?${signalParams}`)]);
+let signalRows: PublicObservation[] = [];
+const signalParams = new URLSearchParams({ limit: String(signalLimit + 1) });
+if (waterbody) signalParams.set("waterbody", waterbody);
+if (fish) signalParams.set("fish", fish);
+const [fishResult, waterResult, signalResult] = await Promise.allSettled([
+  api<DictionaryItem[]>("/api/v1/fishes"), api<DictionaryItem[]>("/api/v1/waterbodies"),
+  api<PublicObservation[]>(`/api/v1/community-observations?${signalParams}`),
+]);
+if (fishResult.status === "fulfilled") fishes = fishResult.value; else fishCatalogUnavailable = true;
+if (waterResult.status === "fulfilled") waterbodies = waterResult.value; else waterCatalogUnavailable = true;
+if (signalResult.status === "fulfilled") signalRows = signalResult.value; else signalsUnavailable = true;
+if (!signalsUnavailable) {
   hasMoreSignals = signalRows.length > signalLimit;
   signals = signalRows.slice(0, signalLimit);
-  if (!filterError) {
-    const query = new URLSearchParams({ hours, waterbody, fish, sort, limit: "20", offset: String(offset) });
+}
+if (!filterError) {
+  const query = new URLSearchParams({ hours, waterbody, fish, sort, limit: String(activityLimit), offset: String(offset) });
+  try {
     const paginated = await api<PaginatedActivity>(`/api/v1/activity?${query}`);
-    items = offset > 0 ? [...items, ...paginated.items] : paginated.items;
+    items = paginated.items;
     totalItems = paginated.total;
+    if (totalItems > 0 && offset >= totalItems) {
+      offset = Math.floor((totalItems - 1) / activityLimit) * activityLimit;
+      query.set("offset", String(offset));
+      items = (await api<PaginatedActivity>(`/api/v1/activity?${query}`)).items;
     }
-} catch {
-  unavailable = true;
+  } catch { activityUnavailable = true; }
+}
+const catalogUnavailable = fishCatalogUnavailable || waterCatalogUnavailable;
+const allUnavailable = activityUnavailable && signalsUnavailable && fishCatalogUnavailable && waterCatalogUnavailable;
+if (!filterError && allUnavailable) {
   showNoIndex = true;
   Astro.response.status = 503;
   Astro.response.headers.set("Retry-After", "60");
+} else if (activityUnavailable || signalsUnavailable || catalogUnavailable) {
+  Astro.response.headers.set("X-RF4-Partial", [activityUnavailable && "activity", signalsUnavailable && "signals", catalogUnavailable && "catalog"].filter(Boolean).join(","));
+  Astro.response.headers.set("Cache-Control", "no-store");
 }
 const leaderLevel = items.length > 1 && items[0] ? activityLevel(items[0].activity_score) : null;
+const leaderMeter = items[0] ? Math.round(Math.min(100, Math.max(0, items[0].activity_score)) / 5) * 5 : 0;
 const selectedWaterbody = waterbodies.find(item => item.slug === waterbody)?.name_ru ?? "Все водоёмы";
 const selectedFish = fishes.find(item => item.slug === fish)?.name_ru ?? "Любая рыба";
 const periodLabel = { "6": "6 часов", "12": "12 часов", "24": "24 часа", "72": "72 часа" }[hours] ?? hours;
 const sortLabel = { activity: "Сначала активные", confidence: "Сначала надёжные", freshness: "Сначала свежие" }[sort] ?? sort;
 const filtersChanged = Boolean(waterbody || fish || hours !== "24" || sort !== "activity");
+const queryTitle = `${selectedFish} · ${selectedWaterbody}`;
 const moreSignalParams = new URLSearchParams(params);
 moreSignalParams.set("signals", String(Math.min(48, signalLimit + 12)));
 const moreSignalsHref = `/?${moreSignalParams.toString()}#signals-title`;
@@ -58,8 +81,9 @@ const datasetJsonLd = {
   creator: { "@type": "Organization", name: "RF4 Spotter" }, isAccessibleForFree: true,
 };
 ---
-<Layout title="Что клюёт сейчас в Russian Fishing 4 — RF4 Spotter" description="Свежие точки клёва RF4, рабочие приманки, вес уловов и прозрачная оценка данных с указанием каждого источника." structuredData={datasetJsonLd} noindex={showNoIndex} errorPage={filterError || unavailable}>
+<Layout title="Что клюёт сейчас в Russian Fishing 4 — RF4 Spotter" description="Свежие точки клёва RF4, рабочие приманки, вес уловов и прозрачная оценка данных с указанием каждого источника." structuredData={datasetJsonLd} noindex={showNoIndex} errorPage={filterError || allUnavailable}>
   <section class="intro content-grid"><div class="intro-copy"><span class="eyebrow"><b>RF4</b> Живая карта клёва</span><h1>Выбирай место,<br/><em>пока клюёт.</em></h1><p>Свежие точки, рабочие приманки и честная оценка данных от игроков.</p></div><div class="lake-card"><img src="/lake-dawn.webp" alt="Туманное озеро на рассвете" width="1774" height="887" fetchpriority="high"/><div class="lake-overlay"><div><span class="overline">Пульс водоёмов</span><strong>{items.length} {plural(items.length, ["точка показывает", "точки показывают", "точек показывают"])} активность</strong></div><div class="pulse-orb"><span></span></div></div></div></section>
+  {catalogUnavailable && <div class="content-grid"><StatePanel tone="unavailable" title="Часть справочников недоступна" description="Фильтры показаны без непроверенных значений; остальные разделы загружаются независимо." /></div>}
   <section class="filters-wrap"><form class="filters content-grid" method="get" action="/#results">
     <label>Водоём<select name="waterbody"><option value="">Все водоёмы</option>{waterbodies.map(x => <option value={x.slug} selected={waterbody === x.slug}>{x.name_ru}</option>)}</select></label>
     <label>Рыба<select name="fish"><option value="">Любая рыба</option>{fishes.map(x => <option value={x.slug} selected={fish === x.slug}>{x.name_ru}</option>)}</select></label>
@@ -69,11 +93,13 @@ const datasetJsonLd = {
     </div></details>
     <button data-action="primary">⌕ Найти клёв</button>
   </form></section>
-  <div class="active-filters content-grid" aria-label="Применённые фильтры"><span>{selectedWaterbody}</span><span>{selectedFish}</span><span>{periodLabel}</span><span>{sortLabel}</span>{filtersChanged && <a href="/#results">Сбросить</a>}</div>
-  <section class="dashboard content-grid" id="results"><div class="results-column"><div class="section-heading"><div><span class="overline">За выбранный период</span><h2>Горячие точки</h2></div><span class="result-count">{items.length} из {totalItems} {plural(totalItems, ["точка", "точки", "точек"])}</span></div>{filterError ? <div class="state error-state"><h2>Некорректные фильтры</h2><p>Выберите период и сортировку из предложенных значений.</p><a data-action="secondary" href="/">Сбросить фильтры</a></div> : unavailable ? <div class="state"><h2>Источник временно недоступен</h2><p>Не показываем устаревшие догадки. Попробуйте позже.</p></div> : items.length ? <><div class="spot-list">{items.map(item => <ActivityCard item={item} />)}</div>{offset + items.length < totalItems && <a class="load-more" data-action="secondary" href={`/?${(() => { const p = new URLSearchParams(params); p.delete("offset"); p.set("offset", String(offset + items.length)); return p.toString(); })()}#results`}>Показать ещё <span>{offset + items.length} из {totalItems}</span> ↓</a>}</> : <div class="state"><h2>Пока нет свежих данных</h2><p>Для выбранных фильтров нет одобренных наблюдений. Расширьте период или выберите другой водоём.</p></div>}</div>
-  {items[0] && leaderLevel && <aside class="detail-card"><div class="detail-head"><div><span class="overline">Лидер активности</span><h2>{items[0].waterbody} <em>{items[0].x}:{items[0].y}</em></h2></div><a href={`/spots/${items[0].spot_id}`} aria-label="Открыть точку"><FishingIcon name="arrow"/></a></div><div class="source-strip">{items[0].sources.map(source => <SourceBadge source={source}/>)}</div><div class="detail-score"><div class="float-gauge" style={`--level:${items[0].activity_score}%`} aria-label={`Индекс активности: ${items[0].activity_score} из 100`}><span class="float-gauge__line"></span><span class="float-gauge__water"></span><span class="float-gauge__bob"><i></i></span><strong>{items[0].activity_score}</strong><small>из 100</small></div><div><span>Индекс активности</span><strong data-activity-level={leaderLevel.short}>{leaderLevel.description}</strong><p>{items[0].explanation}</p></div></div><div class="metric-grid"><div><span><FishingIcon name="ripple"/></span><small>Уверенность</small><strong>{items[0].confidence_score}%</strong></div><div><span><FishingIcon name="angler"/></span><small>{plural(items[0].unique_players, ["Игрок", "Игрока", "Игроков"])}</small><strong>{items[0].unique_players}</strong></div><div><span><FishingIcon name="clock"/></span><small>Последний</small><strong>{ago(items[0].last_confirmed_at)}</strong></div><div><span><FishingIcon name="scale"/></span><small>Средний вес</small><strong>{kg(items[0].average_weight_g)}</strong></div></div><div class="best-lure"><span class="overline">Лучшая связка</span><div><TackleGlyph name={items[0].best_bait}/><strong>{items[0].best_bait ?? "Не указана"}</strong><span>{items[0].catches} {plural(items[0].catches, ["улов", "улова", "уловов"])}</span></div></div><p class="confidence-note"><span>✓</span><span><strong>Оценка объяснима.</strong> Один игрок не может искусственно поднять уверенность.</span></p></aside>}
+  <section class="query-summary content-grid" aria-label="Контекст запроса" aria-live="polite"><div><span class="overline">Ваш запрос</span><h2 id="query-summary-title">{queryTitle}</h2><p>{periodLabel} · {sortLabel}</p></div><div class="query-summary__filters" aria-label="Применённые фильтры"><span>{selectedWaterbody}</span><span>{selectedFish}</span><span>{periodLabel}</span><span>{sortLabel}</span>{filtersChanged && <a href="/#results">Сбросить запрос</a>}</div></section>
+  <section class="dashboard content-grid" id="results"><div class="results-column"><div class="section-heading"><div><span class="overline">За выбранный период</span><h2>Горячие точки</h2></div><span class="result-count">{items.length} на странице · всего {totalItems}</span></div>{filterError ? <div class="state error-state"><h2>Некорректные фильтры</h2><p>Выберите период и сортировку из предложенных значений.</p><a data-action="secondary" href="/">Сбросить фильтры</a></div> : activityUnavailable ? <StatePanel contained={false} tone="unavailable" title="Горячие точки временно недоступны" description="Полевые сигналы и справочники продолжают работать независимо." /> : items.length ? <div class="spot-list">{items.map(item => <ActivityCard item={item} periodLabel={periodLabel} />)}</div> : <div class="state"><h2>Пока нет свежих данных</h2><p>Для выбранных фильтров нет одобренных наблюдений. Расширьте период или выберите другой водоём.</p>{filtersChanged && <a data-action="secondary" href="/#results">Показать все данные</a>}</div>}</div>
+  {items[0] && leaderLevel && <aside class="detail-card"><div class="detail-head"><div><span class="overline">Лидер активности</span><h2>{items[0].waterbody} <em>{items[0].x}:{items[0].y}</em></h2></div><a href={`/spots/${items[0].spot_id}`} aria-label="Открыть точку"><FishingIcon name="arrow"/></a></div><div class="source-strip">{items[0].sources.map(source => <SourceBadge source={source}/>)}</div><div class="detail-score"><div class:list={["float-gauge", `meter-level-${leaderMeter}`]} aria-label={`Индекс активности: ${items[0].activity_score} из 100`}><span class="float-gauge__line"></span><span class="float-gauge__water"></span><span class="float-gauge__bob"><i></i></span><strong>{items[0].activity_score}</strong><small>из 100</small></div><div><span>Индекс активности</span><strong data-activity-level={leaderLevel.short}>{leaderLevel.description}</strong><p>{items[0].explanation}</p></div></div><div class="metric-grid"><div><span><FishingIcon name="ripple"/></span><small>Уверенность</small><strong>{items[0].confidence_score}%</strong></div><div><span><FishingIcon name="angler"/></span><small>{plural(items[0].unique_players, ["Игрок", "Игрока", "Игроков"])}</small><strong>{items[0].unique_players}</strong></div><div><span><FishingIcon name="clock"/></span><small>Последний</small><strong>{ago(items[0].last_confirmed_at)}</strong></div><div><span><FishingIcon name="scale"/></span><small>Средний вес</small><strong>{kg(items[0].average_weight_g)}</strong></div></div><div class="best-lure"><span class="overline">Лучшая связка</span><div><TackleGlyph name={items[0].best_bait}/><strong>{items[0].best_bait ?? "Не указана"}</strong><span>{items[0].catches} {plural(items[0].catches, ["улов", "улова", "уловов"])}</span></div></div><p class="confidence-note"><span>✓</span><span><strong>Оценка объяснима.</strong> Один игрок не может искусственно поднять уверенность.</span></p></aside>}
   </section>
+  {!filterError && !activityUnavailable && <Pagination path="/" params={params} total={totalItems} limit={activityLimit} offset={offset} anchor="#results" itemLabel="точек" />}
   {signals.length > 0 && <SignalFeed signals={signals}/>}
+  {signalsUnavailable && <div class="content-grid"><StatePanel tone="unavailable" title="Полевые сигналы временно недоступны" description="Горячие точки и справочники продолжают работать независимо." /></div>}
   {hasMoreSignals && signalLimit < 48 && <a class="signal-more" data-action="secondary" href={moreSignalsHref}>Показать ещё <span>{signalLimit} из доступных</span> ↓</a>}
   <section class="how-it-works content-grid"><div><span class="overline">Как читать данные</span><h2>Не обещаем рыбу.<br/>Показываем факты.</h2></div><div class="principles"><article><span>01</span><h3>Свежесть</h3><p>Чем старше сообщение, тем меньше оно влияет на активность.</p></article><article><span>02</span><h3>Разные игроки</h3><p>Десять уловов одного человека не равны десяти подтверждениям.</p></article><article><span>03</span><h3>Уверенность</h3><p>Каждая оценка объясняет, сколько данных за ней стоит.</p></article></div></section>
   <script>

apps/web/src/pages/media.astro

@@ -0,0 +1,20 @@
+---
+import EntityMedia from "../components/EntityMedia.astro";
+import PageHero from "../components/PageHero.astro";
+import StatePanel from "../components/StatePanel.astro";
+import Layout from "../layouts/Layout.astro";
+import { api, type MediaAsset } from "../lib/api";
+const allowed = new Set(["fish", "waterbody", "tackle", "reference"]);
+const requested = Astro.url.searchParams.get("type") ?? "fish";
+const type = allowed.has(requested) ? requested : "fish";
+let assets: MediaAsset[] = [], unavailable = false;
+try { assets = await api<MediaAsset[]>(`/api/v1/media/catalog?entity_type=${type}`); } catch { unavailable = true; }
+const labels: Record<string,string> = {fish:"Рыбы",waterbody:"Водоёмы",tackle:"Снасти и приманки",reference:"Справочные материалы"};
+---
+<Layout title={`${labels[type]} RF4 — медиатека RF4 Spotter`} description="Изображения рыб, водоёмов и снастей Russian Fishing 4 с обязательной атрибуцией каждого источника.">
+  <PageHero eyebrow="Визуальный справочник" title="Медиатека" description="Собранные материалы RF4 с источником у каждого изображения. Каталог пополняется по мере импорта и проверки." variant="fish" count={assets.length} />
+  <section class="media-library content-grid">
+    <nav class="media-library__intro" aria-label="Разделы медиатеки"><strong>{labels[type]} · {assets.length}</strong><span><a href="/media?type=fish">Рыбы</a> · <a href="/media?type=waterbody">Водоёмы</a> · <a href="/media?type=tackle">Снасти</a> · <a href="/media?type=reference">Справка</a></span></nav>
+    {unavailable ? <StatePanel tone="unavailable" title="Медиатека временно недоступна" /> : assets.length ? <div class="media-library__grid">{assets.map(asset => <article class="media-library__card"><EntityMedia asset={asset} sourceLink /><h2>{asset.label ?? "Без подписи"}</h2><span>{labels[asset.entity_type]}</span></article>)}</div> : <StatePanel title="В этом разделе пока нет изображений" description="Материалы появятся после следующего импорта." />}
+  </section>
+</Layout>

apps/web/src/pages/plan.astro

@@ -0,0 +1,57 @@
+---
+import Layout from "../layouts/Layout.astro";
+---
+<Layout title="Мой план рыбалки — RF4 Spotter" description="Сохранённые точки рыбалки RF4 без аккаунта: координаты, наживки, свежесть и доверие." noindex>
+  <section class="plan-hero content-grid"><div><span class="eyebrow">Локально на этом устройстве</span><h1>Мой план<br/><em>рыбалки.</em></h1><p>Соберите до пяти точек, сравните их перед выездом и распечатайте список. Данные не отправляются на сервер.</p></div><div class="plan-hero__mark" aria-hidden="true">♢</div></section>
+  <section class="plan-toolbar content-grid" aria-label="Действия с планом"><span data-plan-count>0 из 5 точек</span><div><button data-action="secondary" type="button" data-plan-share>Поделиться планом</button><button data-action="secondary" type="button" data-plan-print>Печать / PDF</button><button data-action="quiet" type="button" data-plan-clear>Очистить план</button><small data-plan-share-status aria-live="polite"></small></div></section>
+  <section class="plan-content content-grid" data-plan-page aria-live="polite"><div class="plan-grid" data-plan-list></div><div class="state" data-plan-empty><h2>План пока пуст</h2><p>Сохраните точку на её detail-странице — она появится здесь.</p><a data-action="secondary" href="/">Посмотреть горячие точки</a></div></section>
+</Layout>
+<script>
+  const planStorageKey = "rf4spotter:fishing-plan";
+  const list = document.querySelector<HTMLElement>("[data-plan-list]");
+  const empty = document.querySelector<HTMLElement>("[data-plan-empty]");
+  const count = document.querySelector<HTMLElement>("[data-plan-count]");
+  const shareStatus = document.querySelector<HTMLElement>("[data-plan-share-status]");
+  const normalisePlan = (value: unknown): Array<Record<string, string>> => {
+    if (!Array.isArray(value)) return [];
+    return value.filter(item => item && typeof item === "object" && typeof item.key === "string" && item.key.startsWith("/spots/")).slice(0, 5).map(item => {
+      const source = item as Record<string, unknown>;
+      return Object.fromEntries(["key", "waterbody", "coordinates", "baits", "freshness", "confidence"].map(key => [key, typeof source[key] === "string" ? source[key] : ""]));
+    });
+  };
+  const readPlan = (): Array<Record<string, string>> => {
+    try { return normalisePlan(JSON.parse(localStorage.getItem(planStorageKey) || "[]")); }
+    catch { return []; }
+  };
+  const shared = new URLSearchParams(location.search).get("plan");
+  if (shared) { try { const imported = normalisePlan(JSON.parse(shared)); if (imported.length) localStorage.setItem(planStorageKey, JSON.stringify(imported)); } catch { if (shareStatus) shareStatus.textContent = "Ссылка плана не распознана"; } }
+  const render = () => {
+    if (!list || !empty) return;
+    const plan = readPlan();
+    list.replaceChildren();
+    empty.hidden = plan.length > 0;
+    if (count) count.textContent = `${plan.length} из 5 точек`;
+    plan.forEach(item => {
+      const card = document.createElement("article"); card.className = "plan-card";
+      const heading = document.createElement("h2"); heading.textContent = item.waterbody || "Водоём не указан";
+      const coordinate = document.createElement("strong"); coordinate.textContent = item.coordinates || "Координаты не указаны";
+      const meta = document.createElement("p"); meta.textContent = item.baits ? `Наживка: ${item.baits.split("|").join(", ")}` : "Наживка не указана";
+      const facts = document.createElement("small"); facts.textContent = [item.freshness ? "Свежесть сохранена" : "Свежесть не указана", item.confidence ? `Доверие: ${item.confidence}%` : "Доверие не рассчитано"].join(" · ");
+      const link = document.createElement("a"); link.href = item.key || "/"; link.textContent = "Открыть точку";
+      const remove = document.createElement("button"); remove.type = "button"; remove.dataset.action = "quiet"; remove.textContent = "Убрать"; remove.addEventListener("click", () => { localStorage.setItem(planStorageKey, JSON.stringify(readPlan().filter(entry => entry.key !== item.key))); render(); });
+      const actions = document.createElement("div"); actions.className = "plan-card__actions"; actions.append(link, remove);
+      card.append(heading, coordinate, meta, facts, actions); list.append(card);
+    });
+  };
+  document.querySelector<HTMLButtonElement>("[data-plan-share]")?.addEventListener("click", async () => {
+    const url = new URL(location.href); url.search = ""; url.searchParams.set("plan", JSON.stringify(readPlan()));
+    try {
+      if (navigator.share) await navigator.share({ title: "Мой план рыбалки RF4", url: url.toString() });
+      else await navigator.clipboard.writeText(url.toString());
+      if (shareStatus) shareStatus.textContent = "Ссылка готова";
+    } catch { if (shareStatus) shareStatus.textContent = "Скопируйте ссылку из адресной строки"; }
+  });
+  document.querySelector<HTMLButtonElement>("[data-plan-print]")?.addEventListener("click", () => window.print());
+  document.querySelector<HTMLButtonElement>("[data-plan-clear]")?.addEventListener("click", () => { localStorage.removeItem(planStorageKey); render(); });
+  render();
+</script>

apps/web/src/pages/records.astro

@@ -4,19 +4,26 @@ import SourceBadge from "../components/SourceBadge.astro";
 import SectionHeading from "../components/SectionHeading.astro";
 import StatePanel from "../components/StatePanel.astro";
 import TackleGlyph from "../components/TackleGlyph.astro";
+import Pagination from "../components/Pagination.astro";
 import { api, kg, type DictionaryItem, type ImportRun, type OfficialRecord, type PaginatedOfficialRecord } from "../lib/api";
 const params = Astro.url.searchParams;
 const fish = params.get("fish") ?? "";
 const waterbody = params.get("waterbody") ?? "";
+const recordsLimit = 50;
 const requestedOffset = Number(params.get("offset") ?? 0);
-const offset = Number.isInteger(requestedOffset) && requestedOffset >= 0 ? requestedOffset : 0;
+let offset = Number.isInteger(requestedOffset) && requestedOffset >= 0 ? requestedOffset : 0;
 let items: OfficialRecord[] = [], runs: ImportRun[] = [], fishes: DictionaryItem[] = [], waterbodies: DictionaryItem[] = [];
 let unavailable = false, showNoIndex = false, totalRecords = 0;
 try {
-  const query = new URLSearchParams({ fish, waterbody, limit: "50", offset: String(offset) });
+  const query = new URLSearchParams({ fish, waterbody, limit: String(recordsLimit), offset: String(offset) });
   const paginated = await api<PaginatedOfficialRecord>(`/api/v1/records?${query}`);
-  items = offset > 0 ? [...items, ...paginated.items] : paginated.items;
+  items = paginated.items;
   totalRecords = paginated.total;
+  if (totalRecords > 0 && offset >= totalRecords) {
+    offset = Math.floor((totalRecords - 1) / recordsLimit) * recordsLimit;
+    query.set("offset", String(offset));
+    items = (await api<PaginatedOfficialRecord>(`/api/v1/records?${query}`)).items;
+  }
   [runs, fishes, waterbodies] = await Promise.all([api<ImportRun[]>("/api/v1/imports?limit=1"), api<DictionaryItem[]>("/api/v1/fishes"), api<DictionaryItem[]>("/api/v1/waterbodies")]);
 } catch { unavailable = true; showNoIndex = true; Astro.response.status = 503; Astro.response.headers.set("Retry-After", "60"); }
 const last = runs[0];
@@ -24,10 +31,10 @@ const last = runs[0];
 <Layout title="Официальные рекорды Russian Fishing 4 — RF4 Spotter" description="Последние официальные рекорды RF4 по рыбам и водоёмам: вес, приманка, игрок, дата и прямая ссылка на источник." noindex={showNoIndex} errorPage={unavailable}>
   <section class="records-hero"><div><span class="eyebrow">Публичные данные RF4</span><h1>Официальные<br/><em>рекорды</em></h1></div><div class="source-status"><span class:list={["status-dot", last?.status]}></span><strong>{last ? `Импорт: ${last.status}` : "Импорт ещё не запускался"}</strong>{last?.finished_at && <small>{new Date(last.finished_at).toLocaleString("ru-RU")} · {last.rows_seen} строк</small>}</div></section>
   <form class="record-filters" method="get"><label>Рыба<select name="fish"><option value="">Любая рыба</option>{fishes.map(item => <option value={item.slug} selected={fish === item.slug}>{item.name_ru}</option>)}</select></label><label>Водоём<select name="waterbody"><option value="">Все водоёмы</option>{waterbodies.map(item => <option value={item.slug} selected={waterbody === item.slug}>{item.name_ru}</option>)}</select></label><button data-action="primary">Фильтровать</button>{(fish || waterbody) && <a data-action="quiet" href="/records">Сбросить</a>}</form>
-  <div class="content-grid"><SectionHeading eyebrow="Официальный источник" title="Последние записи" count={`${items.length} из ${totalRecords} записей`} /></div>
+  <div class="content-grid"><SectionHeading eyebrow="Официальный источник" title="Последние записи" count={`${items.length} на странице · всего ${totalRecords}`} /></div>
   {unavailable && <StatePanel tone="unavailable" title="Источник временно недоступен" description="Сохраняем ранее импортированные данные, но не показываем их как свежее обновление." />}
   {!unavailable && items.length && <div class="record-table"><div class="record-row record-head"><span>Рыба</span><span>Вес</span><span>Водоём</span><span>Приманка</span><span>Игрок</span><span>Дата и источник</span></div>{items.map(record => <article class="record-row"><strong data-label="Рыба">{record.fish}</strong><strong data-label="Вес">{kg(record.weight_g)}</strong><span data-label="Водоём">{record.waterbody}</span><span class="tackle-label" data-label="Приманка"><TackleGlyph name={record.bait} size={24}/><span>{record.bait ?? "—"}</span></span><span data-label="Игрок">{record.player_name ?? "—"}</span><span data-label="Дата и источник" class="record-provenance"><time>{record.record_date ? new Date(record.record_date).toLocaleDateString("ru-RU") : "—"}</time><SourceBadge source={record.source_system} href={record.source_url}/></span></article>)}</div>}
-  {!unavailable && items.length && offset + items.length < totalRecords && <a class="load-more" data-action="secondary" href={`/records?${(() => { const p = new URLSearchParams(params); p.delete("offset"); p.set("offset", String(offset + items.length)); return p.toString(); })()}`}>Показать ещё <span>{offset + items.length} из {totalRecords}</span> ↓</a>}
+  {!unavailable && <Pagination path="/records" params={params} total={totalRecords} limit={recordsLimit} offset={offset} itemLabel="записей" />}
   {!unavailable && !items.length && <StatePanel title="Рекорды ещё не импортированы" description="Для выбранных условий записей пока нет." actionHref="/records" actionLabel="Сбросить фильтры" />}
   <p class="official-note">Источник: <a href="https://rf4game.de/records/region/RU/" rel="noreferrer">официальный сайт Russian Fishing 4</a>. Координаты в официальных таблицах отсутствуют.</p>
 </Layout>

apps/web/src/pages/report.astro

@@ -7,6 +7,7 @@ const state = Astro.url.searchParams.get("state");
 const reportId = Astro.url.searchParams.get("report_id");
 ---
 <Layout title="Добавить улов Russian Fishing 4 — RF4 Spotter" description="Отправьте собственное наблюдение об улове RF4 на проверку и помогите игрокам находить актуальные точки.">
+  <span id="report-state" data-state={state ?? ""} hidden></span>
   <section class="form-hero"><div><span class="eyebrow"><b>+1</b> Помочь сообществу</span><h1>Добавить<br/><em>свой улов</em></h1></div><p>Около минуты — и рабочая точка появится в общей статистике после проверки модератором.</p></section>
   {state === "sent" && <div class="notice success">Улов отправлен на модерацию. Спасибо!</div>}
   {state === "screenshot_sent" && <div class="notice success">Скриншот добавлен к ранее созданной заявке.</div>}
@@ -20,13 +21,15 @@ const reportId = Astro.url.searchParams.get("report_id");
     <fieldset><legend>Главное <span>обязательно</span></legend><div class="form-grid"><label>Рыба *<select name="fish_slug" required>{fishes.map(x => <option value={x.slug}>{x.name_ru}</option>)}</select></label><label>Водоём *<select name="waterbody_slug" required>{waterbodies.map(x => <option value={x.slug}>{x.name_ru}</option>)}</select></label><label>Координата X *<input name="x" type="number" min="-10000" max="10000" placeholder="Например, 72" required /></label><label>Координата Y *<input name="y" type="number" min="-10000" max="10000" placeholder="Например, 84" required /></label><label>Вес, граммы *<input name="weight_g" type="number" min="1" max="3000000" placeholder="1250" required /></label><label>Приманка<input name="bait_name" maxlength="200" placeholder="Название в игре" /></label></div><p class="field-help">Координаты — два целых числа с карты. Вес: 1,25 кг = 1250 г.</p></fieldset>
     <details class="optional-fields"><summary>Дополнительные сведения <span>необязательно</span></summary><div class="form-grid"><label>Способ ловли<select name="fishing_method"><option value="">Не указан</option><option value="spinning">Спиннинг</option><option value="bottom">Донная</option><option value="float">Поплавочная</option></select></label><label>Проводка<input name="retrieve_method" maxlength="100" /></label><label>Скорость проводки<input name="retrieve_speed" type="number" min="0" max="100" /></label><label>Ник игрока<input name="player_name" maxlength="100" /></label></div><label class="wide">Комментарий<textarea name="comment" maxlength="1000" rows="4"></textarea></label><label class="wide">Скриншот, JPEG/PNG/WebP до 8 МБ<input name="screenshot" type="file" accept="image/jpeg,image/png,image/webp" /></label></details><label class="honeypot" aria-hidden="true">Сайт<input name="website" tabindex="-1" autocomplete="off" /></label><p class="privacy">Ник и скриншот необязательны. Из изображения удаляются EXIF и прочие метаданные.</p><label class="consent"><input name="consent" type="checkbox" required /> <span>Я отправляю собственное наблюдение и принимаю <a href="/rules" target="_blank">правила</a> и <a href="/privacy" target="_blank">политику конфиденциальности</a>.</span></label><button data-action="primary" type="submit">Отправить на проверку</button>
   </form>}
-  <script is:inline define:vars={{ state }}>
-    const form = document.querySelector(".report-form"); const key = "rf4-report-draft";
+  <script>
+    const form = document.querySelector<HTMLFormElement>(".report-form");
+    const state = document.querySelector<HTMLElement>("#report-state")?.dataset.state ?? "";
+    const key = "rf4-report-draft";
     // A05: Safe sessionStorage access with error handling
     const safeStorage = {
-      getItem: (k) => { try { return sessionStorage.getItem(k); } catch { return null; } },
-      setItem: (k, v) => { try { sessionStorage.setItem(k, v); } catch {} },
-      removeItem: (k) => { try { sessionStorage.removeItem(k); } catch {} },
+      getItem: (k: string) => { try { return sessionStorage.getItem(k); } catch { return null; } },
+      setItem: (k: string, v: string) => { try { sessionStorage.setItem(k, v); } catch {} },
+      removeItem: (k: string) => { try { sessionStorage.removeItem(k); } catch {} },
     };
     // A05: Restore draft on all error states that don't destroy the submission
     const recoverableStates = ["create_error", "rate_limited", "server_error", "timeout"];
@@ -35,17 +38,19 @@ const reportId = Astro.url.searchParams.get("report_id");
         const draft = JSON.parse(safeStorage.getItem(key) || "{}");
         for (const [name, value] of Object.entries(draft)) {
           const field = form.elements.namedItem(name);
-          if (field && "value" in field) field.value = value;
+          if (field instanceof HTMLInputElement || field instanceof HTMLSelectElement || field instanceof HTMLTextAreaElement) {
+            field.value = String(value);
+          }
         }
       } catch {}
-      document.querySelector("#form-error")?.focus();
+      document.querySelector<HTMLElement>("#form-error")?.focus();
     }
     if (state === "sent" || state === "screenshot_sent") safeStorage.removeItem(key);
     form?.addEventListener("submit", () => {
-      const btn = form.querySelector("button[type=submit]");
+      const btn = form.querySelector<HTMLButtonElement>("button[type=submit]");
       if (btn) { btn.disabled = true; btn.textContent = "Отправка..."; }
       // A05: Save draft before submit, handle sessionStorage unavailable
-      const draft = {};
+      const draft: Record<string, string> = {};
       try {
         for (const [name, value] of new FormData(form)) {
           if (typeof value === "string" && name !== "website") draft[name] = value;

apps/web/src/pages/sitemap.xml.ts

@@ -9,7 +9,7 @@ export const GET: APIRoute = async ({ site }) => {
   const output = (xml: string) => new Response(xml, { headers: { "Content-Type": "application/xml; charset=utf-8", "Cache-Control": "public, max-age=1800" } });
   if (lastGood?.origin === origin && Date.now() - lastGood.at < 1800000) return output(lastGood.xml);
   try {
-    const paths = new Set(["/", "/records", "/report", "/status", "/rules", "/privacy", "/fish", "/waterbodies"]);
+    const paths = new Set(["/", "/records", "/report", "/status", "/rules", "/privacy", "/fish", "/waterbodies", "/media"]);
     for (const [endpoint, prefix] of [["fishes", "fish"], ["waterbodies", "waterbodies"]]) {
       for (let offset = 0; ; offset += 500) {
         const rows = await api<DictionaryItem[]>(`/api/v1/${endpoint}?limit=500&offset=${offset}`);

apps/web/src/pages/spots/[id].astro

@@ -1,12 +1,12 @@
 ---
 import Layout from "../../layouts/Layout.astro";
 import AtlasBreadcrumbs from "../../components/AtlasBreadcrumbs.astro";
-import SourceBadge from "../../components/SourceBadge.astro";
 import CoordinateRadar from "../../components/CoordinateRadar.astro";
 import TackleGlyph from "../../components/TackleGlyph.astro";
 import ActivityTimeline from "../../components/ActivityTimeline.astro";
 import CatchList from "../../components/CatchList.astro";
-import { activityLevel, api, ApiError, plural, type Activity, type Catch, type PaginatedActivity, type Spot } from "../../lib/api";
+import DataPassport from "../../components/DataPassport.astro";
+import { activityLevel, api, ApiError, type Activity, type Catch, type PaginatedActivity, type Spot } from "../../lib/api";
 const { id } = Astro.params;
 let spot: Spot | null = null, catches: Catch[] = [], activity: Activity | null = null, unavailable = false;
 let timeline: { start: string; end: string; count: number }[] = [];
@@ -25,6 +25,7 @@ try {
   if (Astro.response.status === 503) Astro.response.headers.set("Retry-After", "60");
 }
 const level = activity ? activityLevel(activity.activity_score) : null;
+const coordinatePrecision = { exact: "точные", approximate: "приблизительные", area: "район", missing: "не указаны" } as const;
 const spotDescription = spot ? `Свежие уловы и активность на точке ${spot.x}:${spot.y}, ${spot.waterbody}: рыба, вес, приманки и источники данных.` : "Данные точки ловли Russian Fishing 4.";
 const breadcrumbs = spot ? { "@context": "https://schema.org", "@type": "BreadcrumbList", itemListElement: [
   { "@type": "ListItem", position: 1, name: "Сейчас клюёт", item: "https://rf4spotter.ru/" },
@@ -34,7 +35,7 @@ const breadcrumbs = spot ? { "@context": "https://schema.org", "@type": "Breadcr
 <Layout title={spot ? `Точка ${spot.x}:${spot.y}, ${spot.waterbody} — RF4 Spotter` : "Точка не найдена — RF4 Spotter"} description={spotDescription} noindex={!spot} structuredData={breadcrumbs} errorPage={!spot || unavailable}>
   <AtlasBreadcrumbs items={[{ label: "Сейчас клюёт", href: "/" }, ...(spot ? [{ label: spot.waterbody, href: `/waterbodies/${spot.waterbody_slug}` }, { label: `Точка ${spot.x}:${spot.y}` }] : [{ label: "Точка недоступна" }])]} />
   {unavailable || !spot ? <div class="state"><h1>Точка недоступна</h1><p>API не ответил или такой точки нет.</p></div> : <>
-    <section class="spot-hero"><div><span class="eyebrow">{spot.waterbody}</span><h1>Точка {spot.x}:{spot.y}</h1><p>{spot.description}</p><button class="coordinate-copy" data-action="inverse" type="button" data-copy-coordinates={`${spot.x}:${spot.y}`}>Скопировать координаты</button><small class="copy-status" aria-live="polite"></small></div><CoordinateRadar x={spot.x} y={spot.y}/></section>
+    <section class="spot-hero"><div><span class="eyebrow">{spot.waterbody}</span><h1>Точка {spot.x}:{spot.y}</h1><p>{spot.description}</p><p class="coordinate-precision">Точность координат: <strong>{coordinatePrecision[spot.coordinate_precision as keyof typeof coordinatePrecision] ?? "не указаны"}</strong></p><div class="spot-hero__actions"><button class="coordinate-copy" data-action="inverse" type="button" data-copy-coordinates={`${spot.x}:${spot.y}`}>Скопировать координаты</button><button class="plan-save" data-action="inverse" type="button" data-plan-save data-plan-key={Astro.url.pathname} data-plan-waterbody={spot.waterbody} data-plan-coordinates={`${spot.x}:${spot.y}`} data-plan-baits={spot.top_baits.join("|")} data-plan-freshness={activity?.last_confirmed_at ?? ""} data-plan-confidence={activity?.confidence_score ?? ""} aria-pressed="false">Сохранить в план</button><small class="copy-status" aria-live="polite"></small><small class="plan-status" aria-live="polite"></small></div></div><CoordinateRadar x={spot.x} y={spot.y}/></section>
     <div class="periods"><div><strong>{spot.catches_24h}</strong><span>за 24 часа</span></div><div><strong>{spot.catches_3d}</strong><span>за 3 дня</span></div><div><strong>{spot.catches_7d}</strong><span>за 7 дней</span></div></div>
     <ActivityTimeline buckets={timeline}/>
     <div class="activity-legend" aria-label="Уровни активности"><span>Тихо</span><span>Есть сигналы</span><span>Горячо</span></div>
@@ -43,11 +44,11 @@ const breadcrumbs = spot ? { "@context": "https://schema.org", "@type": "Breadcr
         <div class="section-heading"><h2>Последние уловы</h2></div>
         {catches.length ? <CatchList catches={catches}/> : <div class="state compact-state"><h2>Уловов пока нет</h2><p>Для этой точки нет одобренных наблюдений.</p></div>}
       </div>
-      <aside><span class="eyebrow">Оценка за 24 часа</span>{activity && level ? <><h2>{activity.activity_score} / 100</h2><strong data-activity-level={level.short}>{level.description}</strong><div class="source-strip">{activity.sources.map(source => <SourceBadge source={source}/>)}</div><p>{activity.explanation}</p><p class="note">Основано на {activity.catches} {plural(activity.catches, ["наблюдении", "наблюдениях", "наблюдениях"])} от {activity.unique_players} {plural(activity.unique_players, ["игрока", "игроков", "игроков"])}. Уверенность: {activity.confidence_score}%.</p></> : <p>За последние 24 часа данных для расчёта нет.</p>}<span class="eyebrow">Лучшие приманки</span>{spot.top_baits.length ? <ol>{spot.top_baits.map(name => <li><span class="tackle-label"><TackleGlyph name={name} size={24}/><span>{name}</span></span></li>)}</ol> : <p>Недостаточно данных.</p>}<p class="note">Учитываются только одобренные наблюдения.</p></aside>
+      <aside><span class="eyebrow">Оценка за 24 часа</span>{activity && level ? <><h2>{activity.activity_score} / 100</h2><strong data-activity-level={level.short}>{level.description}</strong><p>{activity.explanation}</p><DataPassport sources={activity.sources} observedAt={activity.last_confirmed_at} confidence={activity.confidence_score} sampleSize={activity.catches} independentPlayers={activity.unique_players} coordinatePrecision={activity.coordinate_precision} status={activity.catches < 3 ? "incomplete" : "verified"}/></> : <p>За последние 24 часа данных для расчёта нет.</p>}<h3 class="detail-action-heading">Что взять</h3>{spot.top_baits.length ? <ol>{spot.top_baits.map(name => <li><span class="tackle-label"><TackleGlyph name={name} size={24}/><span>{name}</span></span></li>)}</ol> : <p>Недостаточно данных.</p>}<p class="note">Учитываются только одобренные наблюдения.</p></aside>
     </section>
   </>}
 </Layout>
-<script is:inline>
+<script>
   document.querySelectorAll<HTMLButtonElement>("[data-copy-coordinates]").forEach((button) => {
     button.addEventListener("click", async () => {
       const value = button.dataset.copyCoordinates || "";
@@ -56,4 +57,28 @@ const breadcrumbs = spot ? { "@context": "https://schema.org", "@type": "Breadcr
       catch { if (status) status.textContent = value; }
     });
   });
+  const planStorageKey = "rf4spotter:fishing-plan";
+  const readPlan = (): Array<Record<string, string>> => {
+    try { const value = JSON.parse(localStorage.getItem(planStorageKey) || "[]"); return Array.isArray(value) ? value : []; }
+    catch { return []; }
+  };
+  document.querySelectorAll<HTMLButtonElement>("[data-plan-save]").forEach((button) => {
+    const key = button.dataset.planKey || "";
+    const status = button.parentElement?.querySelector<HTMLElement>(".plan-status");
+    const sync = () => {
+      const saved = readPlan().some(item => item.key === key);
+      button.textContent = saved ? "В плане" : "Сохранить в план";
+      button.setAttribute("aria-pressed", String(saved));
+      button.dataset.saved = String(saved);
+    };
+    sync();
+    button.addEventListener("click", () => {
+      const plan = readPlan();
+      const index = plan.findIndex(item => item.key === key);
+      if (index >= 0) { plan.splice(index, 1); if (status) status.textContent = "Удалено из плана"; }
+      else { plan.unshift({ key, waterbody: button.dataset.planWaterbody || "", coordinates: button.dataset.planCoordinates || "", baits: button.dataset.planBaits || "", freshness: button.dataset.planFreshness || "", confidence: button.dataset.planConfidence || "" }); if (status) status.textContent = "Добавлено в план"; }
+      localStorage.setItem(planStorageKey, JSON.stringify(plan.slice(0, 5)));
+      sync();
+    });
+  });
 </script>

apps/web/src/pages/tackle/index.astro

@@ -0,0 +1,41 @@
+---
+import Layout from "../../layouts/Layout.astro";
+import PageHero from "../../components/PageHero.astro";
+import StatePanel from "../../components/StatePanel.astro";
+import Pagination from "../../components/Pagination.astro";
+import TackleGlyph from "../../components/TackleGlyph.astro";
+import DataPassport from "../../components/DataPassport.astro";
+import { api, type PaginatedTackleItems } from "../../lib/api";
+
+const params = Astro.url.searchParams;
+const category = params.get("category") ?? "";
+const brand = params.get("brand") ?? "";
+const family = params.get("family") ?? "";
+const requestedOffset = Number(params.get("offset") ?? 0);
+const limit = 48;
+const offset = Number.isInteger(requestedOffset) && requestedOffset >= 0 ? requestedOffset : 0;
+const query = new URLSearchParams({ limit: String(limit), offset: String(offset) });
+if (category) query.set("category", category);
+if (brand) query.set("brand", brand);
+if (family) query.set("family", family);
+let result: PaginatedTackleItems = { items: [], total: 0, limit, offset }, unavailable = false;
+try { result = await api<PaginatedTackleItems>(`/api/v1/tackle/items?${query}`); } catch { unavailable = true; }
+if (unavailable) { Astro.response.status = 503; Astro.response.headers.set("Retry-After", "60"); Astro.response.headers.set("Cache-Control", "no-store"); }
+const categoryLabels: Record<string, string> = { bait: "Наживка", lure: "Приманка", rod: "Удилище", reel: "Катушка", line: "Леска", hook: "Крючок", rig: "Монтаж", float: "Поплавок", sinker: "Груз", other: "Другое" };
+const filterParams = new URLSearchParams();
+if (category) filterParams.set("category", category);
+if (brand) filterParams.set("brand", brand);
+if (family) filterParams.set("family", family);
+---
+<Layout title="Снасти и приманки RF4 — RF4 Spotter" description="Канонический каталог снастей, приманок и монтажей Russian Fishing 4 с источниками и отметками неполноты.">
+  <PageHero eyebrow="Канонический справочник" title="Снасти и приманки" description="Показываем только подтверждённые карточки. Пустые поля явно отмечены и не заменяются догадками." variant="fish" count={result.total} />
+  <form class="record-filters" method="get" aria-label="Фильтры каталога снастей">
+    <label>Категория<select name="category"><option value="">Все категории</option>{Object.entries(categoryLabels).map(([value, label]) => <option value={value} selected={category === value}>{label}</option>)}</select></label>
+    <label>Бренд<input name="brand" value={brand} maxlength="100" placeholder="Например, RF4" /></label>
+    <label>Семейство<input name="family" value={family} maxlength="100" placeholder="Название семейства" /></label>
+    <button data-action="primary">Фильтровать</button>
+    {(category || brand || family) && <a data-action="quiet" href="/tackle">Сбросить</a>}
+  </form>
+  {unavailable ? <StatePanel tone="unavailable" title="Каталог временно недоступен" description="Не показываем непроверенные карточки. Попробуйте обновить страницу позже." /> : result.items.length ? <section class="catalog-grid content-grid" aria-label="Карточки снастей">{result.items.map(item => <a href={`/tackle/items/${item.id}`}><TackleGlyph name={item.name} size={32} /><span>{categoryLabels[item.category] ?? item.category}</span><strong>{item.name}</strong><small>{[item.brand, item.family].filter(Boolean).join(" · ") || "Характеристики уточняются"}</small><div class="tackle-card-passport"><DataPassport sources={item.source_system ? [item.source_system] : []} sourceUrl={item.source_url} observedAt={item.source_checked_at} completeness={item.missing_fields.length ? null : 100} status={item.missing_fields.length ? "incomplete" : item.source_checked_at ? "verified" : "unverified"}/></div></a>)}</section> : <StatePanel title="Подтверждённых карточек пока нет" description="Каталог заполнится после разрешённой загрузки и ручной проверки источников." />}
+  {!unavailable && <Pagination path="/tackle" params={filterParams} total={result.total} limit={limit} offset={offset} itemLabel="карточек" />}
+</Layout>

apps/web/src/pages/waterbodies/[slug].astro

@@ -1,15 +1,19 @@
 ---
 import ActivityCard from "../../components/ActivityCard.astro";
+import EntityMedia from "../../components/EntityMedia.astro";
 import AtlasBreadcrumbs from "../../components/AtlasBreadcrumbs.astro";
 import AtlasEntityLink from "../../components/AtlasEntityLink.astro";
 import PageHero from "../../components/PageHero.astro";
 import StatePanel from "../../components/StatePanel.astro";
+import DataPassport from "../../components/DataPassport.astro";
 import Layout from "../../layouts/Layout.astro";
-import { api, plural, type Activity, type DictionaryItem, type PaginatedActivity } from "../../lib/api";
+import { api, plural, type Activity, type DictionaryItem, type MediaAsset, type PaginatedActivity } from "../../lib/api";
+import { findMediaByLabel } from "../../lib/media";
 const { slug } = Astro.params;
-let water: DictionaryItem | undefined, items: Activity[] = [], unavailable = false;
+let water: DictionaryItem | undefined, items: Activity[] = [], media: MediaAsset[] = [], unavailable = false;
 try {
-  const waters = await api<DictionaryItem[]>("/api/v1/waterbodies?limit=500");
+  const [waters, waterMedia] = await Promise.all([api<DictionaryItem[]>("/api/v1/waterbodies?limit=500"), api<MediaAsset[]>("/api/v1/media/catalog?entity_type=waterbody")]);
+  media = waterMedia;
   water = waters.find(item => item.slug === slug);
   if (water) { const paginated = await api<PaginatedActivity>(`/api/v1/activity?hours=72&waterbody=${encodeURIComponent(water.slug)}&limit=100`); items = paginated.items; }
 } catch { unavailable = true; }
@@ -20,10 +24,14 @@ if (unavailable) {
 }
 if (!water && !unavailable) Astro.response.status = 404;
 const fishes = [...new Map(items.map(item => [item.fish_slug, item.fish])).entries()];
+const image = water ? findMediaByLabel(media, water.name_ru) : undefined;
 const schema = water ? { "@context":"https://schema.org", "@type":"CollectionPage", name:`Что ловить на ${water.name_ru} в RF4`, url:`https://rf4spotter.ru/waterbodies/${water.slug}` } : null;
 ---
 <Layout title={water ? `${water.name_ru} в RF4 — рыба и свежие точки` : "Водоём не найден — RF4 Spotter"} description={water ? `${water.name_ru} в Russian Fishing 4: свежие координаты, активные виды рыб, приманки и источники наблюдений.` : "Такого водоёма нет в каталоге RF4 Spotter."} noindex={!water || unavailable} structuredData={schema} errorPage={!water || unavailable}>
   <AtlasBreadcrumbs items={[{ label: "Водоёмы", href: "/waterbodies" }, { label: water?.name_ru ?? "Не найдено" }]} />
   <PageHero eyebrow="Свежие данные за 72 часа" title={water?.name_ru ?? "Водоём не найден"} description={water ? `${items.length} ${plural(items.length,["активная точка","активные точки","активных точек"])} для ${fishes.length} ${plural(fishes.length,["вида рыбы","видов рыб","видов рыб"])}.` : undefined} variant={water ? "water" : undefined} identity={water?.slug} />
-  {unavailable ? <StatePanel tone="unavailable" title="Данные временно недоступны" description="Каталог сохранён, но свежие наблюдения сейчас не получены." /> : !water ? <StatePanel tone="error" title="Такого водоёма нет в справочнике" actionHref="/waterbodies" actionLabel="Открыть каталог" /> : <section class="catalog-results content-grid"><aside><span class="overline">Рыбы</span>{fishes.length ? <nav>{fishes.map(([fishSlug,name]) => <AtlasEntityLink href={`/waterbodies/${water!.slug}/${fishSlug}`} label={name} kind="fish" identity={name} />)}</nav> : <p>Свежих подтверждённых видов пока нет.</p>}</aside><div>{items.length ? items.map(item => <ActivityCard item={item}/>) : <StatePanel contained={false} title="Свежих точек пока нет" description="Проверьте позже или посмотрите полевые сигналы на главной." />}</div></section>}
+  {image && <section class="entity-feature content-grid" aria-label={`Изображение: ${water!.name_ru}`}><EntityMedia asset={image} sourceLink /><div><span class="overline">Карта и образ водоёма</span><h2>{water!.name_ru}</h2><p>Материал показан с прямой атрибуцией. Координаты активных точек ниже относятся к данным наблюдений, а не к геометрии изображения.</p></div></section>}
+  {water && (water.description || water.unlock_level !== undefined || water.source_url || water.source_fish_species) && <section class="data-passport content-grid" aria-label="Паспорт водоёма"><div><span class="overline">Канонические сведения</span><h2>{water.name_ru}</h2>{water.description && <p>{water.description}</p>}{water.unlock_level !== undefined && water.unlock_level !== null && <p>Открывается с уровня: <strong>{water.unlock_level}</strong></p>}{water.source_fish_species?.length && <p>В карточке источника указано видов рыб: <strong>{water.source_fish_species.length}</strong>.</p>}{water.source_aliases?.length && <p>Алиасы источника: {water.source_aliases.join(", ")}.</p>}</div><div><span class="overline">Источник</span>{water.source_url ? <p><a href={water.source_url} rel="noreferrer">{water.source_system ?? "Внешний источник"} · исходная карточка</a></p> : <p>Источник для описания ещё не подтверждён.</p>}{water.source_point_urls?.length && <p>Сохранено ссылок на точки: <strong>{water.source_point_urls.length}</strong>.</p>}{water.source_image_urls?.length && <p>Изображений-кандидатов: <strong>{water.source_image_urls.length}</strong>; публикация требует отдельной проверки.</p>}{water.source_checked_at && <p>Проверено: {new Date(water.source_checked_at).toLocaleDateString("ru-RU")}</p>}</div></section>}
+  {water && <DataPassport sources={water.source_system ? [water.source_system] : []} sourceUrl={water.source_url} observedAt={water.source_checked_at} status={water.source_checked_at ? "verified" : "unverified"}/>}
+  {unavailable ? <StatePanel tone="unavailable" title="Данные временно недоступны" description="Каталог сохранён, но свежие наблюдения сейчас не получены." /> : !water ? <StatePanel tone="error" title="Такого водоёма нет в справочнике" actionHref="/waterbodies" actionLabel="Открыть каталог" /> : <section class="catalog-results content-grid"><aside><span class="overline">Рыбы</span>{fishes.length ? <nav>{fishes.map(([fishSlug,name]) => <AtlasEntityLink href={`/waterbodies/${water!.slug}/${fishSlug}`} label={name} kind="fish" identity={name} />)}</nav> : <p>Свежих подтверждённых видов пока нет.</p>}</aside><div>{items.length ? items.map(item => <ActivityCard item={item} periodLabel="72 часа"/>) : <StatePanel contained={false} title="Свежих точек пока нет" description="Проверьте позже или посмотрите полевые сигналы на главной." />}</div></section>}
 </Layout>

apps/web/src/pages/waterbodies/[slug]/[fish].astro

@@ -24,5 +24,5 @@ const schema = valid ? { "@type":"CollectionPage", name:`${fish!.name_ru} на $
 <Layout title={valid ? `${fish!.name_ru} на ${water!.name_ru} в RF4 — точки и приманки` : "Страница не найдена — RF4 Spotter"} description={valid ? `Где ловить ${fish!.name_ru} на ${water!.name_ru} в Russian Fishing 4: свежие координаты, приманки, активность и источники.` : "Такого сочетания рыбы и водоёма нет в каталоге."} noindex={!valid || unavailable} structuredData={schema} errorPage={!valid || unavailable}>
   <AtlasBreadcrumbs items={[{ label: "Водоёмы", href: "/waterbodies" }, { label: water?.name_ru ?? "Не найдено", href: water ? `/waterbodies/${water.slug}` : undefined }, { label: fish?.name_ru ?? "Не найдено" }]} />
   <PageHero eyebrow={water?.name_ru ?? "Каталог RF4"} title={fish?.name_ru ?? "Данные не найдены"} description={valid ? `${items.length} ${plural(items.length,["свежая точка","свежие точки","свежих точек"])} за последние 72 часа.` : undefined} variant={valid ? "pair" : undefined} identity={fish?.name_ru} secondaryIdentity={water?.slug} />
-  {unavailable ? <StatePanel tone="unavailable" title="Данные временно недоступны" description="Свежие наблюдения сейчас не получены. Попробуйте позднее." /> : !valid ? <StatePanel tone="error" title="Такого сочетания нет в справочнике" actionHref="/" actionLabel="Вернуться на главную" /> : <section class="catalog-results catalog-results--single content-grid"><div>{items.length ? items.map(item => <ActivityCard item={item}/>) : <StatePanel contained={false} title="Свежих точек пока нет" description="Данные появятся после новых подтверждённых наблюдений." />}</div></section>}
+  {unavailable ? <StatePanel tone="unavailable" title="Данные временно недоступны" description="Свежие наблюдения сейчас не получены. Попробуйте позднее." /> : !valid ? <StatePanel tone="error" title="Такого сочетания нет в справочнике" actionHref="/" actionLabel="Вернуться на главную" /> : <section class="catalog-results catalog-results--single content-grid"><div>{items.length ? items.map(item => <ActivityCard item={item} periodLabel="72 часа"/>) : <StatePanel contained={false} title="Свежих точек пока нет" description="Данные появятся после новых подтверждённых наблюдений." />}</div></section>}
 </Layout>

apps/web/src/pages/waterbodies/index.astro

@@ -3,9 +3,18 @@ import Layout from "../../layouts/Layout.astro";
 import PageHero from "../../components/PageHero.astro";
 import StatePanel from "../../components/StatePanel.astro";
 import WaterbodyMark from "../../components/WaterbodyMark.astro";
+import Pagination from "../../components/Pagination.astro";
 import { api, type DictionaryItem } from "../../lib/api";
-let waters: DictionaryItem[] = [], unavailable = false;
-try { waters = await api<DictionaryItem[]>("/api/v1/waterbodies?limit=500"); } catch { unavailable = true; }
+const params = Astro.url.searchParams;
+const pageLimit = 48;
+const requestedOffset = Number(params.get("offset") ?? 0);
+let offset = Number.isInteger(requestedOffset) && requestedOffset >= 0 ? requestedOffset : 0;
+let waters: DictionaryItem[] = [], allWaters: DictionaryItem[] = [], unavailable = false;
+try {
+  allWaters = await api<DictionaryItem[]>("/api/v1/waterbodies?limit=500");
+  if (allWaters.length > 0 && offset >= allWaters.length) offset = Math.floor((allWaters.length - 1) / pageLimit) * pageLimit;
+  waters = allWaters.slice(offset, offset + pageLimit);
+} catch { unavailable = true; }
 if (unavailable) {
   Astro.response.status = 503;
   Astro.response.headers.set("Retry-After", "60");
@@ -13,6 +22,7 @@ if (unavailable) {
 }
 ---
 <Layout title="Все водоёмы Russian Fishing 4 — RF4 Spotter" description="Каталог водоёмов RF4 со свежими точками, рыбами, приманками и прозрачными источниками данных.">
-  <PageHero eyebrow="Карта водоёмов RF4" title="Водоёмы" description="Откройте водоём, чтобы увидеть активные виды рыб и последние подтверждённые точки." variant="water" count={waters.length} />
-  {unavailable ? <StatePanel tone="unavailable" title="Каталог временно недоступен" description="Не показываем непроверенный список. Попробуйте обновить страницу позже." /> : <nav class="catalog-grid catalog-grid--waters content-grid" aria-label="Водоёмы">{waters.map((water,index) => <a href={`/waterbodies/${water.slug}`}><span>Водоём · {String(index + 1).padStart(2,"0")}</span><strong>{water.name_ru}</strong><i>Открыть <b>→</b></i><WaterbodyMark identity={water.slug}/></a>)}</nav>}
+  <PageHero eyebrow="Карта водоёмов RF4" title="Водоёмы" description="Откройте водоём, чтобы увидеть активные виды рыб и последние подтверждённые точки." variant="water" count={allWaters.length} />
+  {unavailable ? <StatePanel tone="unavailable" title="Каталог временно недоступен" description="Не показываем непроверенный список. Попробуйте обновить страницу позже." /> : <nav class="catalog-grid catalog-grid--waters content-grid" aria-label="Водоёмы">{waters.map((water,index) => <a href={`/waterbodies/${water.slug}`}><span>Водоём · {String(offset + index + 1).padStart(2,"0")}</span><strong>{water.name_ru}</strong><i>Открыть <b>→</b></i><WaterbodyMark identity={water.slug}/></a>)}</nav>}
+  {!unavailable && <Pagination path="/waterbodies" params={params} total={allWaters.length} limit={pageLimit} offset={offset} itemLabel="водоёмов" />}
 </Layout>

apps/web/src/styles/activity-timeline.css

@@ -1,3 +1,3 @@
-.activity-timeline{width:min(1180px,calc(100% - 64px));margin:20px auto 0;padding:25px 28px;border-radius:14px;background:#fff;border:1px solid #d9e1da}.activity-timeline header{display:flex;align-items:end;justify-content:space-between;gap:20px}.activity-timeline h2{font:400 29px Georgia,serif;margin:5px 0 0}.activity-timeline header p{margin:0;color:#71817e;font-size:10px}
-.timeline-chart{height:145px;display:grid;grid-template-columns:repeat(6,1fr);gap:8px;margin-top:18px;padding-top:8px;border-bottom:1px solid #a9bbb1;background:repeating-linear-gradient(to top,transparent 0,transparent 35px,#dce5de 36px)}.timeline-slot{position:relative;display:grid;grid-template-rows:1fr auto;place-items:center}.timeline-line{position:relative;align-self:end;width:2px;height:var(--height);min-height:10px;background:#3f7779}.timeline-line i{position:absolute;left:0;top:0;width:12px;height:18px;margin:-4px 0 0 -5px;border-radius:7px 7px 9px 9px;background:linear-gradient(#ff785a 0 35%,var(--lime) 35%);box-shadow:0 0 0 4px #c9f45b18}.timeline-slot strong{position:absolute;top:2px;font:400 14px Georgia,serif;color:#365c5e}.timeline-slot small{position:absolute;bottom:-20px;color:#71817e;font-size:8px;white-space:nowrap}.activity-timeline+*{margin-top:42px}
+.activity-timeline{width:min(1180px,calc(100% - 64px));margin:20px auto 0;padding:25px 28px;border-radius:14px;background:var(--surface);border:1px solid var(--border-soft)}.activity-timeline header{display:flex;align-items:end;justify-content:space-between;gap:20px}.activity-timeline h2{font:400 29px Georgia,serif;margin:5px 0 0}.activity-timeline header p{margin:0;color:var(--text-muted);font-size:10px}
+.timeline-chart{height:145px;display:grid;grid-template-columns:repeat(6,1fr);gap:8px;margin-top:18px;padding-top:8px;border-bottom:1px solid var(--border);background:repeating-linear-gradient(to top,transparent 0,transparent 35px,var(--graphic-grid) 36px)}.timeline-slot{position:relative;display:grid;grid-template-rows:1fr auto;place-items:center}.timeline-line{position:relative;align-self:end;width:2px;height:var(--meter-level);min-height:10px;background:var(--graphic-line)}.timeline-line i{position:absolute;left:0;top:0;width:12px;height:18px;margin:-4px 0 0 -5px;border-radius:7px 7px 9px 9px;background:linear-gradient(#ff785a 0 35%,var(--lime) 35%);box-shadow:0 0 0 4px color-mix(in srgb,var(--lime) 12%,transparent)}.timeline-slot strong{position:absolute;top:2px;font:400 14px Georgia,serif;color:var(--text)}.timeline-slot small{position:absolute;bottom:-20px;color:var(--text-muted);font-size:8px;white-space:nowrap}.activity-timeline+*{margin-top:42px}
 @media(max-width:720px){.activity-timeline{width:calc(100% - 28px);padding:20px 15px}.activity-timeline header{display:block}.activity-timeline header p{margin-top:6px}.timeline-slot small{font-size:7px}}

apps/web/src/styles/coordinate-radar.css

@@ -1 +1 @@
-.coordinate-radar{position:relative;flex:0 0 180px;width:180px;height:180px;display:grid;place-items:center;color:var(--lime)}.coordinate-radar svg{position:absolute;inset:0;width:100%;height:100%;fill:none;stroke:#ffffff20;stroke-width:1}.coordinate-radar .radar-sweep{fill:#c9f45b0d;stroke:#c9f45b38}.coordinate-radar .radar-mark{fill:var(--lime);stroke:none}.coordinate-radar .radar-pulse{stroke:var(--lime);stroke-width:2;opacity:.55}.coordinate-radar strong{position:relative;display:grid;grid-template-columns:auto auto 1px auto auto;align-items:baseline;gap:4px;padding:7px 10px;border-radius:7px;background:#082226d9;font:400 20px Georgia,serif}.coordinate-radar strong small{font:700 8px Inter,sans-serif;color:#9eb0ad}.coordinate-radar strong i{width:1px;height:14px;background:#ffffff35}.radar-north{position:absolute;top:3px;font-size:8px;letter-spacing:.15em}.radar-caption{position:absolute;bottom:1px;color:#91a5a1;font-size:8px;text-transform:uppercase;letter-spacing:.12em}@media(max-width:720px){.coordinate-radar{display:none}}
+.coordinate-radar{position:relative;flex:0 0 180px;width:180px;height:180px;display:grid;place-items:center;color:var(--lime)}.coordinate-radar svg{position:absolute;inset:0;width:100%;height:100%;fill:none;stroke:color-mix(in srgb,var(--text-on-dark) 13%,transparent);stroke-width:1}.coordinate-radar .radar-sweep{fill:color-mix(in srgb,var(--lime) 5%,transparent);stroke:color-mix(in srgb,var(--lime) 22%,transparent)}.coordinate-radar .radar-mark{fill:var(--lime);stroke:none}.coordinate-radar .radar-pulse{stroke:var(--lime);stroke-width:2;opacity:.55}.coordinate-radar strong{position:relative;display:grid;grid-template-columns:auto auto 1px auto auto;align-items:baseline;gap:4px;padding:7px 10px;border-radius:7px;background:color-mix(in srgb,var(--deep) 85%,transparent);font:400 20px Georgia,serif}.coordinate-radar strong small{font:700 8px Inter,sans-serif;color:color-mix(in srgb,var(--text-on-dark) 65%,transparent)}.coordinate-radar strong i{width:1px;height:14px;background:color-mix(in srgb,var(--text-on-dark) 22%,transparent)}.radar-north{position:absolute;top:3px;font-size:8px;letter-spacing:.15em}.radar-caption{position:absolute;bottom:1px;color:color-mix(in srgb,var(--text-on-dark) 60%,transparent);font-size:8px;text-transform:uppercase;letter-spacing:.12em}@media(max-width:720px){.coordinate-radar{display:none}}

apps/web/src/styles/data-passport.css

@@ -1,5 +1,6 @@
 .data-passport{margin-top:18px;padding:14px;border:1px solid var(--border);border-radius:13px;background:var(--surface-soft);color:var(--deep)}
-.data-passport header{display:flex;align-items:center;justify-content:space-between;gap:12px;margin-bottom:11px}.data-passport header>span{font:italic 15px Georgia,serif}.data-passport header strong{padding:4px 8px;border-radius:999px;background:var(--success-soft);color:var(--success);font-size:9px;text-transform:uppercase;letter-spacing:.06em}.data-passport header strong[data-passport-status="unverified"]{background:#e8e2f4;color:#59438d}.data-passport header strong[data-passport-status="incomplete"]{background:var(--warning-soft);color:var(--warning)}
-.data-passport__sources{display:flex;flex-wrap:wrap;gap:5px;margin-bottom:12px}.data-passport dl{display:grid;grid-template-columns:repeat(3,1fr);gap:8px;margin:0}.data-passport dl div{padding-top:8px;border-top:1px solid var(--border-soft)}.data-passport dt{font-size:8px;text-transform:uppercase;letter-spacing:.08em;color:var(--text-subtle)}.data-passport dd{margin:3px 0 0;font:400 12px Georgia,serif;color:var(--deep)}
+.data-passport header{display:flex;align-items:center;justify-content:space-between;gap:12px;margin-bottom:11px}.data-passport header>span{font:italic 15px Georgia,serif}.data-passport header strong{padding:4px 8px;border-radius:999px;background:var(--success-soft);color:var(--success);font-size:9px;text-transform:uppercase;letter-spacing:.06em}.data-passport header strong[data-passport-status="unverified"]{background:var(--info-soft);color:var(--info)}.data-passport header strong[data-passport-status="incomplete"],.data-passport header strong[data-passport-status="stale"]{background:var(--warning-soft);color:var(--warning)}
+.data-passport__sources{display:flex;flex-wrap:wrap;gap:5px;margin-bottom:12px}.data-passport dl{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:8px;margin:0}.data-passport dl div{padding-top:8px;border-top:1px solid var(--border-soft)}.data-passport dt{font-size:8px;text-transform:uppercase;letter-spacing:.08em;color:var(--text-subtle)}.data-passport dd{margin:3px 0 0;font:400 12px Georgia,serif;color:var(--deep)}
+.data-passport__minimum{margin:12px 0 0;color:var(--warning);font-size:11px;line-height:1.4}
 .detail-card .data-passport,.detail-grid aside .data-passport{border-color:#ffffff20;background:#ffffff08;color:#fff}.detail-card .data-passport dd,.detail-grid aside .data-passport dd{color:#fff}.detail-card .data-passport dl div,.detail-grid aside .data-passport dl div{border-color:#ffffff1c}.detail-card .data-passport dt,.detail-grid aside .data-passport dt{color:#a9b8b5}.signal-card .data-passport{position:relative;z-index:1;margin-top:15px;background:#fffdf7;border-color:#ddd3af}
-@media(max-width:420px){.data-passport dl{grid-template-columns:1fr}.data-passport dl div{display:flex;justify-content:space-between;gap:10px}}
+@media(max-width:720px){.data-passport dl{grid-template-columns:repeat(2,minmax(0,1fr))}}@media(max-width:420px){.data-passport dl{grid-template-columns:1fr}.data-passport dl div{display:flex;justify-content:space-between;gap:10px}}

apps/web/src/styles/fish-silhouette.css

@@ -1 +1 @@
-.fish-silhouette{fill:currentColor;color:#315f63;pointer-events:none}.fish-silhouette .fish-eye{fill:var(--paper)}.fish-silhouette .fish-detail{fill:none;stroke:currentColor;stroke-width:1.8;stroke-linecap:round}.spot-main{position:relative}.spot-main>.fish-silhouette{position:absolute;right:2px;top:38px;opacity:.075}.catalog-grid>a{position:relative;overflow:hidden}.catalog-grid>a>.fish-silhouette{position:absolute;right:20px;bottom:12px;opacity:.12;transform:rotate(-4deg);transition:opacity var(--motion-base) var(--ease-out),transform var(--motion-base) var(--ease-out)}.catalog-grid>a:hover>.fish-silhouette{opacity:.2;transform:rotate(-2deg) translateX(-2px)}@media(max-width:720px){.spot-main>.fish-silhouette{width:68px;right:0;opacity:.055}}
+.fish-silhouette{fill:currentColor;color:var(--decorative-water);pointer-events:none}.fish-silhouette .fish-eye{fill:var(--paper)}.fish-silhouette .fish-detail{fill:none;stroke:currentColor;stroke-width:1.8;stroke-linecap:round}.spot-main{position:relative}.spot-main>.fish-silhouette{position:absolute;right:2px;top:38px;opacity:.075}.catalog-grid>a{position:relative;overflow:hidden}.catalog-grid>a>.fish-silhouette{position:absolute;right:20px;bottom:12px;opacity:.12;transform:rotate(-4deg);transition:opacity var(--motion-base) var(--ease-out),transform var(--motion-base) var(--ease-out)}.catalog-grid>a:hover>.fish-silhouette{opacity:.2;transform:rotate(-2deg) translateX(-2px)}@media(max-width:720px){.spot-main>.fish-silhouette{width:68px;right:0;opacity:.055}}