UI overhaul + multi-user implementation aligned with the 2.0RC.1 plan

.gitattributes

@@ -1,3 +1,7 @@
 *.* linguist-language=C#
-*.jar filter=lfs diff=lfs merge=lfs -text
-*.dll filter=lfs diff=lfs merge=lfs -text
+
+# Force LF line endings for scripts and CI files so they run on Linux runners.
+.githooks/** text eol=lf
+*.sh text eol=lf
+.github/workflows/*.yml text eol=lf
+.github/workflows/*.yaml text eol=lf

.githooks/pre-commit

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+# Local guard mirroring .github/workflows/guard-binaries.yml.
+# Blocks commits that introduce build artifacts or oversized binaries.
+#
+# To enable for this clone:
+#   git config core.hooksPath .githooks
+#
+# Bypass (NOT recommended; CI will still reject):
+#   git commit --no-verify
+
+set -euo pipefail
+
+MAX_SIZE=$((50 * 1024 * 1024))   # 50 MB
+MAX_JAR=$((10 * 1024 * 1024))    # 10 MB for .jar
+
+FORBIDDEN_PREFIXES=(
+  "Mihon.ExtensionsBridge.Net/libs/Android.Compat.dll"
+  "Mihon.ExtensionsBridge.Net/IKVM.Android.Compatibility.Layer.CILPatcher/libs/"
+)
+
+STAGED=$(git diff --cached --name-only --diff-filter=AM || true)
+
+if [ -z "$STAGED" ]; then
+  exit 0
+fi
+
+FAIL=0
+
+while IFS= read -r FILE; do
+  [ -n "$FILE" ] || continue
+  [ -f "$FILE" ] || continue
+
+  for PREFIX in "${FORBIDDEN_PREFIXES[@]}"; do
+    case "$FILE" in
+      "$PREFIX"*)
+        echo "ERROR: $FILE is a forbidden build-artifact path ($PREFIX)."
+        echo "       Build outputs belong in GitHub Releases, not git."
+        FAIL=1
+        ;;
+    esac
+  done
+
+  case "$FILE" in
+    */build/libs/*.jar)
+      echo "ERROR: $FILE is a Gradle build output. Add to .gitignore and publish via Releases."
+      FAIL=1
+      ;;
+    */bin/Release/*.dll|*/bin/Release/*/*.dll|*/bin/Debug/*.dll|*/bin/Debug/*/*.dll)
+      echo "ERROR: $FILE is a .NET build output. Add to .gitignore and publish via Releases."
+      FAIL=1
+      ;;
+  esac
+
+  SIZE=$(wc -c < "$FILE")
+
+  if [ "$SIZE" -gt "$MAX_SIZE" ]; then
+    SIZE_MB=$((SIZE / 1024 / 1024))
+    echo "ERROR: $FILE is ${SIZE_MB} MB (limit 50 MB). Use Releases for large binaries."
+    FAIL=1
+  fi
+
+  case "$FILE" in
+    *.jar)
+      if [ "$SIZE" -gt "$MAX_JAR" ]; then
+        SIZE_MB=$((SIZE / 1024 / 1024))
+        echo "ERROR: $FILE is a ${SIZE_MB} MB .jar (limit 10 MB). Use Releases."
+        FAIL=1
+      fi
+      ;;
+  esac
+done <<< "$STAGED"
+
+if [ "$FAIL" -eq 1 ]; then
+  echo ""
+  echo "Pre-commit guard rejected this commit."
+  echo "Bypass with --no-verify (CI will still enforce)."
+  exit 1
+fi
+
+exit 0

.github/workflows/build-desktop-tray.yml

@@ -0,0 +1,270 @@
+name: Build Desktop Tray
+
+# Builds the KaizokuTray Avalonia desktop application as self-contained
+# single-file binaries for Windows and Linux (x64 + arm64), then publishes
+# them to a GitHub Release.
+#
+# Triggers:
+#   - Push of a tag matching v*  -> auto-build + publish release named after the tag
+#   - Manual dispatch            -> requires 'version' input
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version tag for the release (e.g. v1.0.0). Required."
+        required: true
+        type: string
+      draft:
+        description: "Publish as draft release"
+        required: false
+        type: boolean
+        default: false
+      prerelease:
+        description: "Mark release as prerelease"
+        required: false
+        type: boolean
+        default: false
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  prepare:
+    name: Prepare shared build inputs
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Download Android.Compat.dll from release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          DLL_PATH="Mihon.ExtensionsBridge.Net/libs/Android.Compat.dll"
+          mkdir -p "$(dirname "$DLL_PATH")"
+          gh release download android-compat-v1 \
+            --repo "${{ github.repository }}" \
+            --pattern "Android.Compat.dll" \
+            --dir "$(dirname "$DLL_PATH")" \
+            --clobber
+          echo "Downloaded: $(du -h "$DLL_PATH" | cut -f1)"
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+
+      - name: Build Frontend
+        working-directory: KaizokuFrontend
+        run: |
+          pnpm install --frozen-lockfile
+          pnpm run build
+
+      - name: Package Frontend for Backend
+        run: |
+          set -euo pipefail
+          cd KaizokuFrontend/out
+          zip -r ../../KaizokuBackend/wwwroot.zip .
+          cd ../..
+          sha256sum KaizokuBackend/wwwroot.zip | awk '{print $1}' > KaizokuBackend/wwwroot.sha256
+          echo "wwwroot.zip:    $(du -h KaizokuBackend/wwwroot.zip | cut -f1)"
+          echo "wwwroot.sha256: $(cat KaizokuBackend/wwwroot.sha256)"
+
+      - name: Upload prep artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: build-prep
+          path: |
+            Mihon.ExtensionsBridge.Net/libs/Android.Compat.dll
+            KaizokuBackend/wwwroot.zip
+            KaizokuBackend/wwwroot.sha256
+          retention-days: 1
+          if-no-files-found: error
+
+  build:
+    name: Build (${{ matrix.rid }})
+    needs: prepare
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - rid: win-x64
+            archive_ext: zip
+          - rid: win-arm64
+            archive_ext: zip
+          - rid: linux-x64
+            archive_ext: tar.gz
+          - rid: linux-arm64
+            archive_ext: tar.gz
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET 8
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "8.0.x"
+
+      - name: Download prep artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: build-prep
+          path: .
+
+      - name: Verify prep artifacts
+        run: |
+          set -euo pipefail
+          test -f Mihon.ExtensionsBridge.Net/libs/Android.Compat.dll
+          test -f KaizokuBackend/wwwroot.zip
+          test -f KaizokuBackend/wwwroot.sha256
+          echo "All prep artifacts present."
+
+      - name: Determine version
+        id: version
+        run: |
+          set -euo pipefail
+          if [ "${{ github.event_name }}" = "push" ]; then
+            VERSION="${GITHUB_REF_NAME}"
+          else
+            VERSION="${{ inputs.version }}"
+          fi
+          if [ -z "$VERSION" ]; then
+            echo "::error::No version available. Push a v* tag or provide 'version' input."
+            exit 1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "Building version: $VERSION"
+
+      - name: Publish single-file binary
+        run: |
+          set -euo pipefail
+          dotnet publish KaizokuTray/KaizokuTray.csproj \
+            -c Release \
+            -r ${{ matrix.rid }} \
+            --self-contained true \
+            -p:PublishSingleFile=true \
+            -p:IncludeNativeLibrariesForSelfExtract=true \
+            -p:EnableCompressionInSingleFile=true \
+            -p:DebugType=embedded \
+            -o publish/${{ matrix.rid }}
+
+      - name: List publish output
+        run: ls -la publish/${{ matrix.rid }}/
+
+      - name: Package
+        id: package
+        run: |
+          set -euo pipefail
+          NAME="KaizokuTray-${{ steps.version.outputs.version }}-${{ matrix.rid }}"
+          mkdir -p dist
+
+          if [ "${{ matrix.archive_ext }}" = "zip" ]; then
+            (cd publish/${{ matrix.rid }} && zip -9 -r "../../dist/${NAME}.zip" .)
+            ASSET="dist/${NAME}.zip"
+          else
+            tar -czf "dist/${NAME}.tar.gz" -C publish/${{ matrix.rid }} .
+            ASSET="dist/${NAME}.tar.gz"
+          fi
+
+          echo "asset=$ASSET" >> "$GITHUB_OUTPUT"
+          echo "Packaged: $ASSET ($(du -h "$ASSET" | cut -f1))"
+
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: kaizoku-tray-${{ matrix.rid }}
+          path: ${{ steps.package.outputs.asset }}
+          retention-days: 30
+          if-no-files-found: error
+
+  release:
+    name: Publish Release
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Determine version
+        id: version
+        run: |
+          set -euo pipefail
+          if [ "${{ github.event_name }}" = "push" ]; then
+            VERSION="${GITHUB_REF_NAME}"
+          else
+            VERSION="${{ inputs.version }}"
+          fi
+          if [ -z "$VERSION" ]; then
+            echo "::error::No version available."
+            exit 1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Download all build artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: dist
+          pattern: kaizoku-tray-*
+          merge-multiple: true
+
+      - name: List release assets
+        run: ls -la dist/
+
+      - name: Publish or update release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ steps.version.outputs.version }}
+          DRAFT: ${{ inputs.draft }}
+          PRERELEASE: ${{ inputs.prerelease }}
+        run: |
+          set -euo pipefail
+
+          NOTES=$(cat <<EOF
+          Desktop tray application builds for Kaizoku.NET ${VERSION}.
+
+          ## Assets
+
+          - Windows x64: \`KaizokuTray-${VERSION}-win-x64.zip\`
+          - Windows ARM64: \`KaizokuTray-${VERSION}-win-arm64.zip\`
+          - Linux x64: \`KaizokuTray-${VERSION}-linux-x64.tar.gz\`
+          - Linux ARM64: \`KaizokuTray-${VERSION}-linux-arm64.tar.gz\`
+
+          Builds are self-contained single-file binaries; no .NET runtime install required.
+
+          **Note:** Binaries are unsigned. Windows SmartScreen or antivirus may warn on first run; macOS users are not currently supported (build target not yet enabled).
+          EOF
+          )
+
+          FLAGS=()
+          if [ "${DRAFT:-false}" = "true" ]; then
+            FLAGS+=("--draft")
+          fi
+          if [ "${PRERELEASE:-false}" = "true" ]; then
+            FLAGS+=("--prerelease")
+          fi
+
+          if gh release view "$VERSION" --repo "${{ github.repository }}" >/dev/null 2>&1; then
+            gh release upload "$VERSION" dist/* \
+              --clobber \
+              --repo "${{ github.repository }}"
+            gh release edit "$VERSION" \
+              --notes "$NOTES" \
+              --repo "${{ github.repository }}"
+            echo "Updated existing release $VERSION with $(ls dist/ | wc -l) assets."
+          else
+            gh release create "$VERSION" dist/* \
+              --repo "${{ github.repository }}" \
+              --title "Kaizoku.NET $VERSION" \
+              --notes "$NOTES" \
+              "${FLAGS[@]}"
+            echo "Created release $VERSION with $(ls dist/ | wc -l) assets."
+          fi

.github/workflows/docker-build.yml

@@ -38,7 +38,17 @@ jobs:
         uses: actions/checkout@v4
         with:
           ref: ${{ inputs.branch }}
-          lfs: true
+
+      - name: Download Android.Compat.dll from release
+        run: |
+          DLL_PATH="Mihon.ExtensionsBridge.Net/libs/Android.Compat.dll"
+          gh release download android-compat-v1 \
+            --pattern "Android.Compat.dll" \
+            --dir "$(dirname "$DLL_PATH")" \
+            --clobber
+          echo "Downloaded: $(du -h "$DLL_PATH" | cut -f1)"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
@@ -58,6 +68,15 @@ jobs:
         with:
           dotnet-version: '8.0.x'
 
+      - name: Verify Android.Compat.dll
+        run: |
+          DLL="Mihon.ExtensionsBridge.Net/libs/Android.Compat.dll"
+          if [ ! -f "$DLL" ]; then
+            echo "::error::Android.Compat.dll not found. Run the 'Rebuild Android.Compat.dll' workflow first."
+            exit 1
+          fi
+          echo "Android.Compat.dll: $(du -h "$DLL" | cut -f1)"
+
       - name: Setup Node.js and pnpm
         uses: actions/setup-node@v4
         with: